CVE-2020-7663: Regular Expression Denial of Service in websocket-extensions (RubyGem)
Summary
CVE-2020-7663: Regular Expression Denial of Service in websocket-extensions (RubyGem). Affects websocket-extensions versions < 0.1.5. Fixed in 0.1.5. How to fix ↓
Also tracked for
- ruby-websocket-extensions · Debian:11
The same CVE-2020-7663 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The websocket-extensions RubyGem is a package that provides functionality for WebSocket extensions in Ruby applications. WebSocket extensions allow for additional features and capabilities to be added to WebSocket communications. This vulnerability affects versions prior to 0.1.5 of the websocket-extensions RubyGem.
Vulnerability Detail
The vulnerability, known as Regular Expression Denial of Service (ReDoS), allows an attacker to exhaust the server's capacity to process incoming requests by sending a WebSocket handshake request with a specific header. By including an unclosed string parameter value containing a repeating two-byte sequence of a backslash and another character, the server's parser takes exponential time to reject the header as invalid. This can lead to a denial of service (DoS) situation, rendering the service completely unavailable. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.2.
How To Fix
Latest published version: 0.1.5 as of 23 Oct 2026
gem install websocket-extensions -v 0.1.5The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability other than disabling any public-facing WebSocket functionality that may be in use.
Conclusion
In conclusion, the websocket-extensions RubyGem is vulnerable to a Regular Expression Denial of Service (ReDoS) flaw that can lead to a denial of service (DoS) situation. Users should upgrade to version 0.1.5 to fix this vulnerability. There are no known workarounds other than disabling public-facing WebSocket functionality. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for websocket-extensions →
FAQ
The impact of this vulnerability is that an attacker can exhaust the server's capacity to process requests, leading to a denial of service (DoS) situation and rendering the service completely unavailable.
To mitigate the risk, it is recommended to upgrade to version 0.1.5 of the websocket-extensions RubyGem as soon as possible.
No, there are no known workarounds for this vulnerability other than disabling public-facing WebSocket functionality.
There is no evidence of active exploits at this time, but it is important to apply the recommended patch to protect against potential attacks.
More information about this vulnerability can be found in the advisory published by GitHub: [link to advisory]
References
Related vulnerabilities
Recent vulnerabilities recorded for websocket-extensions.
