{"cve":"CVE-2026-54464","nvd":{"published":"2026-07-17T20:17:26.770","modified":"2026-10-24T20:10:00.137","status":"Deferred","description":"### Impact\n\nIf this library is used in tandem with the `permessage-deflate` extension, a\nWebSocket server or client can be made to accept messages that are larger than\nthe configured maximum message size. This is because this limit is checked\nagainst the message frames' length headers, which give the size of the\ncompressed data, not the size after decompression. This can lead to applications\naccepting larger messages than expected and exceeding their intended resource\nusage.\n\n### Patches\n\nThe issue has been patched in version 0.8.1, by checking the length of messages\nafter they are processed by incoming extensions. All users should upgrade to\nthis version.\n\n### Workarounds\n\nNo known workarounds exist.\n\n### Acknowledgements\n\nThis issue was discovered and reported by Pranjali Thakur, DepthFirst Security\nResearch Team.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","score":6.3},"cvss_v3":null,"cwes":["CWE-770"],"references":["https://github.com/faye/websocket-driver-ruby/commit/fa8641724f10bf3273585f1dcf9041f540bbd036","https://github.com/faye/websocket-driver-ruby/security/advisories/GHSA-33ph-fccm-39pj"],"products":[],"source":"nvd","synced_at":"2026-10-25T17:50:08.599881581+00:00"},"epss":{"cve":"CVE-2026-54464","score":0.00445,"percentile":0.384,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-33ph-fccm-39pj","url":"https://osv.dev/vulnerability/GHSA-33ph-fccm-39pj","summary":"websocket-driver: Resource limit bypass via message compression","modified":"2026-09-10T03:50:51.444898994Z","packages":[{"ecosystem":"RubyGems","name":"websocket-driver","purl":"pkg:gem/websocket-driver","ranges":["<0.8.1"],"fixed":["0.8.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}