The library incorrectly verifies the configured maximum message size against the length header of compressed frames, not the size after decompression. As a result, a malicious sender can deliver a compressed payload that uncompresses to a size greater than the allowed limit. This bypass lets the server accept and process oversized messages, potentially exhausting memory or other resources and leading to application instability or denial of service. The weakness is a CWE-770, pathological resource consumption.

The vulnerability affects the faye websocket-driver-ruby library. Versions prior to 0.8.1 are impacted. Applications that use this library in conjunction with the permessage‑deflate WebSocket extension are at risk.

The score of 6.3 indicates a moderate severity. EPSS is less than one percent, suggesting a low probability that this flaw will be actively exploited in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must be able to establish a WebSocket connection that negotiates the permessage‑deflate extension and then transmit a carefully crafted compressed frame. If successful, the server would allocate memory for and process the uncompressed message, potentially causing a denial of service. No public workaround is available, so prevention relies on applying the patch.