The driver contains a flaw in its handling of WebSocket protocol length headers. The length header can encode an arbitrarily large integer using high‑bit bytes, and the parser will expand that into an ever‑growing Ruby integer. This flaw is a memory allocation issue (CWE‑770). An attacker can send a crafted WebSocket message that forces this integer to grow without bound, exhausting the process’s memory and causing it to crash or become unresponsive, leading to a denial of service rather than code execution.

Faye’s websocket‑driver‑ruby is affected in all releases before version 0.8.1. Any installed instance of the driver that has not been updated to 0.8.1 or later is vulnerable.

The CVSS score of 6.9 indicates moderate to high severity, and the EPSS score of less than 1% suggests exploitation opportunities are currently low. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, via a client that initiates a WebSocket connection to a server or client using the vulnerable driver. An adversary can trigger the exhaustion by repeatedly sending oversized length‑header fields, leading to memory exhaustion and denial of service at the victim host.