GHSA-8j3g-f24p-4mpw

Suggest an improvement
Source
https://github.com/advisories/GHSA-8j3g-f24p-4mpw
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-8j3g-f24p-4mpw/GHSA-8j3g-f24p-4mpw.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8j3g-f24p-4mpw
Aliases
Downstream
CGA (52)
MINI (2)
Published
2026-07-15T22:05:39Z
Modified
2026-09-10T03:50:51Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L CVSS Calculator
Summary
websocket-driver: Memory exhaustion in HTTP header parser
Details

Impact

If this library is used to implement a WebSocket server on top of a TCP server (rather than an HTTP server or framework) using the WebSocket::Driver.server() method, or, if it is used to complement a WebSocket client, then a peer can make a single connection consume an unbounded amount of memory by sending an HTTP request or response with a never-ending list of headers. This can lead to the receiving process running out of memory.

Patches

The issue has been patched in version 0.8.1, by limiting the total size of HTTP request/response lines and headers accepted by the parser to 32 kB. All users should upgrade to this version.

Workarounds

No known workarounds exist.

Acknowledgements

This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.

Database specific 
{
    "cwe_ids":  [
        "CWE-400",
        "CWE-770"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-15T22:05:39Z",
    "nvd_published_at":  "2026-07-17T20:17:26Z",
    "severity":  "MODERATE"
}
References

Affected packages

RubyGems / websocket-driver

Package

Name
websocket-driver
Purl
pkg:gem/websocket-driver

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.8.1

Affected versions

0.*
0.1.0
0.2.0
0.2.1
0.2.2
0.2.3
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.3.5
0.4.0
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-8j3g-f24p-4mpw/GHSA-8j3g-f24p-4mpw.json"