The websocket‑driver Ruby implementation parses HTTP headers during the WebSocket handshake without an upper bound on the total header size or list of headers. Because the parser allocates memory for each header entry, an attacker can cause the application process to consume an unbounded amount of memory, eventually exhausting available system RAM and forcing the process to crash or become unresponsive. This flaw is a classic example of CWE‑770: Excessive Resource Consumption.

The vulnerability impacts versions of faye::websocket-driver‑ruby prior to 0.8.1 that are used to build WebSocket servers over TCP or to augment WebSocket clients. Any deployment that relies on a pre‑0.8.1 release of this library and exposes a public or network reachable TCP endpoint is susceptible.

With a CVSS score of 6.3 the flaw is considered medium severity, and an EPSS score of < 1% indicates a very low probability of exploitation in the wild. The attacker only needs the ability to open a WebSocket connection to the vulnerable service, so the attack vector is likely remote over TCP. Because the exploit requires a single connection to trigger the resource drain, a determined adversary could use this vector to disrupt service availability or to enable a denial‑of‑service attack as part of a broader compromise.