CVE-2026-61666

Name	CVE-2026-61666
Description	websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server() passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when the application does not catch the error from parse(). This issue is fixed in version 0.8.2.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ruby-websocket-driver (PTS)	bookworm, trixie	0.6.3-3	vulnerable
	forky, sid	0.8.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
ruby-websocket-driver	source	(unstable)	0.8.2-1

Notes

[trixie] - ruby-websocket-driver <no-dsa> (Minor issue)
[bookworm] - ruby-websocket-driver <postponed> (Minor issue)
https://github.com/faye/websocket-driver-ruby/security/advisories/GHSA-2x63-gw47-w4mm
Fixed by: https://github.com/faye/websocket-driver-ruby/commit/7d6fd87759a2fdc83590d3b49ffa661dc53fa128 (0.8.2)