CVE-2026-54464

### Impact If this library is used in tandem with the `permessage-deflate` extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size. This is because this limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. ### Patches The issue has been patched in version 0.8.1, by checking the length of messages after they are processed by incoming extensions. All users should upgrade to this version. ### Workarounds No known workarounds exist. ### Acknowledgements This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.

• CWE-770

• https://github.com/faye/websocket-driver-ruby/commit/fa8641724f10bf3273585f1dcf9041f540bbd036
• https://github.com/faye/websocket-driver-ruby/security/advisories/GHSA-33ph-fccm-39pj

Published

Jul 17, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54445vantage6 is an open-source infrastructure for privacy preser…6.9
• CVE-2026-54448Trivy is a security scanner. Prior to 0.71.0, when Trivy sca…6.5
• CVE-2026-5445An out-of-bounds read vulnerability exists in the `DecodeLoo…9.1
• CVE-2026-54458WWBN AVideo is an open source video platform. Versions prior…9.6
• CVE-2026-5446In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS …7.1
• CVE-2026-54463websocket-driver is a WebSocket protocol handler with plugga…7.5
• CVE-2026-54465websocket-driver is a WebSocket protocol handler with plugga…7.5
• CVE-2026-54466websocket-driver is a WebSocket protocol handler with plugga…7.5
• CVE-2026-54468Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, …6.5
• CVE-2026-54469Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, …8.8
• CVE-2026-5447Heap buffer overflow in CertFromX509 via AuthorityKeyIdentif…7.5
• CVE-2026-54470Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior c…5.3