CyberRota Analysis
AI-GeneratedWebSocket::Driver versions prior to 0.8.2 are vulnerable to a denial-of-service attack due to improper handling of malformed Host headers, which can lead to a crash of the TCP-backed WebSocket server. This vulnerability poses a significant risk to applications utilizing WebSocket::Driver, particularly those that do not implement their own error handling for URI parsing. Organizations using affected versions should prioritize upgrading to version 0.8.2 or later to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server() passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when the application does not catch the error from parse(). This issue is fixed in version 0.8.2.