Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-u29q-3x9x-73da
Vulnerability ID VCID-u29q-3x9x-73da
Aliases CVE-2020-7663
GHSA-g6wq-qcwm-j5g2
Summary Regular Expression Denial of Service in websocket-extensions (RubyGem) ### Impact The ReDoS flaw allows an attacker to exhaust the server's capacity to process incoming requests by sending a WebSocket handshake request containing a header of the following form: Sec-WebSocket-Extensions: a; b="\c\c\c\c\c\c\c\c\c\c ... That is, a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. The parser takes exponential time to reject this header as invalid, and this will block the processing of any other work on the same thread. Thus if you are running a single-threaded server, such a request can render your service completely unavailable. ### Patches Users should upgrade to version 0.1.5. ### Workarounds There are no known work-arounds other than disabling any public-facing WebSocket functionality you are operating. ### References - https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions/
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-400 Uncontrolled Resource Consumption
CWE-20 Improper Input Validation
CWE-185 Incorrect Regular Expression
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-7663.json
epss 0.0242 https://api.first.org/data/v1/epss?cve=CVE-2020-7663
epss 0.0242 https://api.first.org/data/v1/epss?cve=CVE-2020-7663
epss 0.0242 https://api.first.org/data/v1/epss?cve=CVE-2020-7663
epss 0.0242 https://api.first.org/data/v1/epss?cve=CVE-2020-7663
epss 0.0242 https://api.first.org/data/v1/epss?cve=CVE-2020-7663
epss 0.0242 https://api.first.org/data/v1/epss?cve=CVE-2020-7663
epss 0.0242 https://api.first.org/data/v1/epss?cve=CVE-2020-7663
epss 0.0242 https://api.first.org/data/v1/epss?cve=CVE-2020-7663
epss 0.0242 https://api.first.org/data/v1/epss?cve=CVE-2020-7663
epss 0.0242 https://api.first.org/data/v1/epss?cve=CVE-2020-7663
epss 0.0242 https://api.first.org/data/v1/epss?cve=CVE-2020-7663
epss 0.0242 https://api.first.org/data/v1/epss?cve=CVE-2020-7663
epss 0.0242 https://api.first.org/data/v1/epss?cve=CVE-2020-7663
epss 0.0242 https://api.first.org/data/v1/epss?cve=CVE-2020-7663
epss 0.0242 https://api.first.org/data/v1/epss?cve=CVE-2020-7663
cvssv3.1 8.2 https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions
generic_textual HIGH https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions
cvssv3.1 4.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-g6wq-qcwm-j5g2
cvssv3.1 8.2 https://github.com/faye/websocket-extensions-ruby
generic_textual HIGH https://github.com/faye/websocket-extensions-ruby
cvssv3.1 8.2 https://github.com/faye/websocket-extensions-ruby/commit/aa156a439da681361ed6f53f1a8131892418838b
generic_textual HIGH https://github.com/faye/websocket-extensions-ruby/commit/aa156a439da681361ed6f53f1a8131892418838b
cvssv3 7.5 https://github.com/faye/websocket-extensions-ruby/security/advisories/GHSA-g6wq-qcwm-j5g2
cvssv3.1 8.2 https://github.com/faye/websocket-extensions-ruby/security/advisories/GHSA-g6wq-qcwm-j5g2
cvssv3.1_qr HIGH https://github.com/faye/websocket-extensions-ruby/security/advisories/GHSA-g6wq-qcwm-j5g2
generic_textual HIGH https://github.com/faye/websocket-extensions-ruby/security/advisories/GHSA-g6wq-qcwm-j5g2
cvssv3.1 8.2 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/websocket-extensions/CVE-2020-7663.yml
generic_textual HIGH https://github.com/rubysec/ruby-advisory-db/blob/master/gems/websocket-extensions/CVE-2020-7663.yml
cvssv3.1 8.2 https://lists.debian.org/debian-lts-announce/2020/08/msg00031.html
generic_textual HIGH https://lists.debian.org/debian-lts-announce/2020/08/msg00031.html
cvssv3.1 8.2 https://nvd.nist.gov/vuln/detail/CVE-2020-7663
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2020-7663
cvssv3.1 8.2 https://snyk.io/vuln/SNYK-RUBY-WEBSOCKETEXTENSIONS-570830
generic_textual HIGH https://snyk.io/vuln/SNYK-RUBY-WEBSOCKETEXTENSIONS-570830
cvssv3.1 8.2 https://usn.ubuntu.com/4502-1
generic_textual HIGH https://usn.ubuntu.com/4502-1
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-7663.json
https://api.first.org/data/v1/epss?cve=CVE-2020-7663
https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7663
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/faye/websocket-extensions-ruby
https://github.com/faye/websocket-extensions-ruby/commit/aa156a439da681361ed6f53f1a8131892418838b
https://github.com/faye/websocket-extensions-ruby/security/advisories/GHSA-g6wq-qcwm-j5g2
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/websocket-extensions/CVE-2020-7663.yml
https://lists.debian.org/debian-lts-announce/2020/08/msg00031.html
https://nvd.nist.gov/vuln/detail/CVE-2020-7663
https://snyk.io/vuln/SNYK-RUBY-WEBSOCKETEXTENSIONS-570830
https://usn.ubuntu.com/4502-1
https://usn.ubuntu.com/4502-1/
1845978 https://bugzilla.redhat.com/show_bug.cgi?id=1845978
964274 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=964274
GHSA-g6wq-qcwm-j5g2 https://github.com/advisories/GHSA-g6wq-qcwm-j5g2
RHSA-2020:4366 https://access.redhat.com/errata/RHSA-2020:4366
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-7663.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H Found at https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H Found at https://github.com/faye/websocket-extensions-ruby
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H Found at https://github.com/faye/websocket-extensions-ruby/commit/aa156a439da681361ed6f53f1a8131892418838b
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H Found at https://github.com/faye/websocket-extensions-ruby/security/advisories/GHSA-g6wq-qcwm-j5g2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/websocket-extensions/CVE-2020-7663.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H Found at https://lists.debian.org/debian-lts-announce/2020/08/msg00031.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2020-7663
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H Found at https://snyk.io/vuln/SNYK-RUBY-WEBSOCKETEXTENSIONS-570830
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H Found at https://usn.ubuntu.com/4502-1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.85055
EPSS Score 0.0242
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:00:27.301087+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/06/GHSA-g6wq-qcwm-j5g2/GHSA-g6wq-qcwm-j5g2.json 38.0.0