CVE-2026-54465
High
Description
websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, when websocket-driver is used to implement a WebSocket server on top of a TCP server using WebSocket::Driver.server() or to complement a WebSocket client, a peer can make a single connection consume an unbounded amount of memory by sending an HTTP request or response with a never-ending list of headers. This can lead to the receiving process running out of memory. This issue is fixed in version 0.8.1.
SeverityHigh
CVSS7.5
Exploit probability—
ProductFaye Websocket-driver
PublishedJul 17, 2026
First seenJul 17, 2026
Weakness typeCWE-770Allocation of resources without limits
How to fix
Update
- faye websocket-driver0.8.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| faye websocket-driver | v < 0.8.1 | 0.8.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.