websocket-driver Gem Vulnerability: Memory Exhaustion Threat
The websocket-driver gem is reportedly vulnerable to memory exhaustion via abuse of protocol length headers, affecting versions prior to 0.8.1.
What happened
An early warning has been issued regarding a high severity vulnerability in the websocket-driver gem. This vulnerability, tracked under GHSA-GHHP-3QVG-889P, appears to allow memory exhaustion through the abuse of protocol length headers. Draft versions of the WebSocket protocol permit an attacker to send an indefinite sequence of bytes with high bit values, potentially causing the other peer to consume an unbounded amount of memory. This issue is under investigation, and it is recommended to upgrade to websocket-driver version 0.8.1 to mitigate the risk. For more detailed information, primary sources should be consulted.
How 0Day mitigates this
websocket-driver is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.