Description
websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.
Published: 2020-06-02
Score: 7.5 High
EPSS: 2.4% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-2334-1 ruby-websocket-extensions security update
EUVD EUVD EUVD-2020-0487 websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.
Github GHSA Github GHSA GHSA-g6wq-qcwm-j5g2 Regular Expression Denial of Service in websocket-extensions (RubyGem)
Ubuntu USN Ubuntu USN USN-4502-1 websocket-extensions vulnerability
History

Sat, 12 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00585}

epss

{'score': 0.00635}


Subscriptions

Canonical Ubuntu Linux
Debian Debian Linux
Redhat Satellite Satellite Capsule
Websocket-extensions Project Websocket-extensions
cve-icon MITRE

Status: PUBLISHED

Assigner: snyk

Published:

Updated: 2024-08-04T09:33:20.058Z

Reserved: 2020-01-21T00:00:00.000Z

Link: CVE-2020-7663

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2020-06-02T19:15:12.467

Modified: 2024-11-21T05:37:33.930

Link: CVE-2020-7663

cve-icon Redhat

Severity : Important

Publid Date: 2020-06-02T00:00:00Z

Links: CVE-2020-7663 - Bugzilla

cve-icon OpenCVE Enrichment

No data.