CVE-2026-61666

highcovered by 1 sourcefirst seen 2026-07-21

Impact If this library is used to implement a WebSocket server on top of a TCP server, by using the WebSocket::Driver.server() method, then a client can cause the server to crash by sending a Host header that is not a valid host[:port] string. When this happens, a URI::InvalidURIError exception is raised which is not caught, and this can cause the server process to crash if the application does not catch the error from the parse() method itself. Patches The issue has been patched in version 0.8.2 by making the request parser catch URI::InvalidURIError and enter an error state if the Host header is malformed. This means the request is considered invalid and should not establish a WebSocket connection. Workarounds No known workarounds exist. Acknowledgements This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.

⚡ Watch CVE-2026-61666

Get an email if CVE-2026-61666 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

highGHSA-2x63-gw47-w4mm: websocket-driver-ruby: Denial of service via malformed Host headerghsa · 2026-07-21

External references

NVD record for CVE-2026-61666

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-61666 status](https://www.csirts.com/badge/CVE-2026-61666)](https://www.csirts.com/cve/CVE-2026-61666)