Skip to main content

Uncaught Exception

CVE-2026-61666

High
8.9/10

Summary

If this library is used to implement a WebSocket server on top of a TCP server, by using the `WebSocket::Driver.server()` method, then a client can cause the server to crash by sending a `Host` header that is not a valid `host[:port]` string. When this happens, a `URI::InvalidURIError` exception is raised which is not caught, and this can cause the server process to crash if the application does not catch the error from the `parse()` method itself. All versions prior to 0.8.2 are affected.

  • LOW
  • NETWORK
  • NONE
  • NONE

CWE-248 - Uncaught Exception

An exception is thrown from a function, but it is not caught.

References

Advisory Timeline

  • Published