CVE-2026-54463

Name of the Vulnerable Software and Affected Versions websocket-driver versions prior to 0.8.1

Description Draft versions of the WebSocket protocol in the handler include a length header that allows an arbitrarily large integer to be encoded as bytes with the high bit set. A server or client can send an indefinite sequence of bytes with values 0x80 or higher, which the peer parses into an ever-growing Ruby integer. Because Ruby integers use arbitrary precision, this process can cause a WebSocket connection to consume an unbounded amount of memory, potentially leading the host process to run out of memory.

Recommendations Update to version 0.8.1.