CVE-2026-54465

Katalog CVE

CVSS 7.5 · High EPSS 0,49%

Kerentanan Allocation of Resources Without Limits or Throttling pada faye websocket-driver. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, when websocket-driver is used to implement a WebSocket server on top of a TCP server using WebSocket::Driver.server() or to complement a WebSocket client, a peer can make a single connection consume an unbounded amount of memory by sending an HTTP request or response with a never-ending list of headers. This can lead to the receiving process running out of memory. This issue is fixed in version 0.8.1.

Rincian

Terbit di NVD

17 Juli 2026

Terakhir diubah

6 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/faye/websocket-driver-ruby/security/advisories/GHSA-8j3g-f24p-4mpw advisory vendor
• https://github.com/faye/websocket-driver-ruby/commit/17b569f232896e71d458404ccf4854f80e987710 patch