Ruby websocket driver: websocket-driver is a WebSocket protocol handler with pluggable I/O. (CVE-2026-61666)

The ruby-websocket-driver library versions prior to 0.8.2 contain a vulnerability where the WebSocket::Driver.server() method forwards a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError exceptions. This lack of error handling allows a remote attacker to cause a denial of service by crashing the TCP-backed WebSocket server if the application does not implement its own error handling for this condition. The vulnerability is addressed in version 0.8.2 by properly handling or avoiding the unhandled exception.

A remote unauthenticated attacker can cause a denial of service by crashing the WebSocket server through sending a malformed Host header. This results in server downtime or service disruption until the server is restarted or the error is handled. There is no indication of code execution or data compromise from this vulnerability.

Upgrade ruby-websocket-driver to version 0.8.2 or later where this issue is fixed. If upgrading is not immediately possible, ensure that the application using the library properly catches URI::InvalidURIError exceptions from URI.parse to prevent server crashes.