{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/websocket-driver--0.8.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["websocket-driver (\u003c 0.8.2)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","vulnerability","ruby","webserver"],"_cs_type":"advisory","_cs_vendors":["RubyGems"],"content_html":"\u003cp\u003eA high-severity denial of service (DoS) vulnerability, tracked as CVE-2026-61666, has been identified in the \u003ccode\u003ewebsocket-driver-ruby\u003c/code\u003e library, specifically affecting versions prior to 0.8.2. This vulnerability impacts applications that use the library to implement a WebSocket server via the \u003ccode\u003eWebSocket::Driver.server()\u003c/code\u003e method. An unauthenticated remote attacker can exploit this flaw by sending an HTTP request containing a malformed \u003ccode\u003eHost\u003c/code\u003e header, one that does not conform to the standard \u003ccode\u003ehost[:port]\u003c/code\u003e string format. This malformed header triggers a \u003ccode\u003eURI::InvalidURIError\u003c/code\u003e exception within the library's parsing logic. If the vulnerable application does not explicitly catch this specific exception, the unhandled error will cause the server process to crash, leading to a complete denial of service for the affected WebSocket server. The issue has been patched in version 0.8.2, which includes error handling for invalid \u003ccode\u003eHost\u003c/code\u003e headers.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a target application running a WebSocket server using the \u003ccode\u003ewebsocket-driver\u003c/code\u003e library (versions prior to 0.8.2) through the \u003ccode\u003eWebSocket::Driver.server()\u003c/code\u003e method.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a standard HTTP GET request intended for the WebSocket server.\u003c/li\u003e\n\u003cli\u003eThe crafted request includes a \u003ccode\u003eHost\u003c/code\u003e header that is malformed, specifically containing characters or structures that violate the \u003ccode\u003ehost[:port]\u003c/code\u003e format (e.g., \u003ccode\u003eHost: invalid host.com\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ewebsocket-driver\u003c/code\u003e library's internal parsing mechanisms attempt to process the malformed \u003ccode\u003eHost\u003c/code\u003e header received from the attacker's request.\u003c/li\u003e\n\u003cli\u003eDuring the parsing of the malformed \u003ccode\u003eHost\u003c/code\u003e header, the library encounters an invalid URI string, which raises a \u003ccode\u003eURI::InvalidURIError\u003c/code\u003e exception.\u003c/li\u003e\n\u003cli\u003eBecause the vulnerable application utilizing the \u003ccode\u003ewebsocket-driver\u003c/code\u003e library does not have specific error handling in place to catch the \u003ccode\u003eURI::InvalidURIError\u003c/code\u003e exception from the \u003ccode\u003eparse()\u003c/code\u003e method, the exception propagates unhandled.\u003c/li\u003e\n\u003cli\u003eThe unhandled exception causes the entire WebSocket server process to terminate abruptly, leading to a crash and making the service unavailable to legitimate users.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully achieves a denial of service, rendering the WebSocket server inoperable until manually restarted.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of CVE-2026-61666 results in a denial of service (DoS) for affected WebSocket servers. When a malformed \u003ccode\u003eHost\u003c/code\u003e header is processed, a \u003ccode\u003eURI::InvalidURIError\u003c/code\u003e is raised. If the application does not explicitly catch this error, the server process will crash, making the WebSocket service completely unavailable. This can lead to significant downtime for any services relying on the WebSocket communication, disrupting real-time functionalities, data synchronization, or interactive applications. There are no specific victim numbers or targeted sectors mentioned, but any organization using the vulnerable \u003ccode\u003ewebsocket-driver\u003c/code\u003e gem in a server capacity is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch all instances of \u003ccode\u003ewebsocket-driver\u003c/code\u003e to version 0.8.2 or later immediately to mitigate CVE-2026-61666.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to your SIEM to detect attempts at exploiting CVE-2026-61666 by identifying malformed \u003ccode\u003eHost\u003c/code\u003e headers.\u003c/li\u003e\n\u003cli\u003eEnsure webserver logs capture full HTTP request headers, especially the \u003ccode\u003eHost\u003c/code\u003e header, to enable detection of the patterns specified in the Sigma rule.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T18:36:13Z","date_published":"2026-07-21T18:36:13Z","id":"https://feed.craftedsignal.io/briefs/2026-07-websocket-driver-dos/","summary":"A denial of service vulnerability (CVE-2026-61666) exists in the websocket-driver-ruby library when used to implement a WebSocket server via `WebSocket::Driver.server()`, allowing a remote attacker to send a malformed `Host` header causing a `URI::InvalidURIError` exception and subsequent server process crash if unhandled.","title":"Denial of Service in websocket-driver-ruby via Malformed Host Header (CVE-2026-61666)","url":"https://feed.craftedsignal.io/briefs/2026-07-websocket-driver-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Websocket-Driver (\u003c 0.8.2)","version":"https://jsonfeed.org/version/1.1"}