The WebSocket::Driver.server() method passes a malformed Host header to URI.parse without handling URI::InvalidURIError, causing the parser to raise an exception that terminates the server if unhandled. This flaw maps to CWE-248 and allows a remote client to trigger a crash by sending an invalid Host header, leading to a denial of service at the application level.

The issue affects the faye websocket-driver-ruby library. All releases prior to 0.8.2 are vulnerable. Ruby applications using this library to host WebSocket services are at risk until the library is updated or guarded against the failure.

With a CVSS score of 8.9, this vulnerability is classified as High severity and is not listed in CISA’s KEV catalog. The EPSS score is not available, but the lack of a known public exploit suggests the risk of exploitation is moderate. An attacker who can reach the WebSocket endpoint can send a crafted Host header to cause an unhandled exception, crash the server, and deny service to legitimate users. The attack requires network access to the WebSocket port and does not rely on privilege escalation or advanced scripting.