CVE-2026-54465 (Medium) detected in websocket-driver-0.8.0.gem

[mend-bolt-for-github]

CVE-2026-54465 - Medium Severity Vulnerability

Vulnerable Library - websocket-driver-0.8.0.gem

Library home page: https://rubygems.org/gems/websocket-driver-0.8.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/websocket-driver-0.8.0.gem

Dependency Hierarchy:

• rails-8.0.5.gem (Root Library)
  • actioncable-8.0.5.gem
    • ❌ websocket-driver-0.8.0.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, when websocket-driver is used to implement a WebSocket server on top of a TCP server using WebSocket::Driver.server() or to complement a WebSocket client, a peer can make a single connection consume an unbounded amount of memory by sending an HTTP request or response with a never-ending list of headers. This can lead to the receiving process running out of memory. This issue is fixed in version 0.8.1.

Publish Date: 2026-07-17

URL: CVE-2026-54465

CVSS 3 Score Details (5.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8j3g-f24p-4mpw

Release Date: 2026-07-15

Fix Resolution: websocket-driver - 0.8.1

---

Step up your Open Source Security Game with Mend here