TI-2020-06183 Aliases CVE-2020-7663 GHSA-g6wq-qcwm-j5g2

Uncontrolled resource consumption in websocket-extensions

MEDIUM 40CWE-400Published 2020-06-02 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.

Why it matters now

EPSS 0.04639 91st percentileScored 2026-11-07

Fix Partial websocket-extensions (ruby): 0.1.5websocket-extensions (RubyGems): 0.1.5Red Hat: 1 advisoryRed Hat: 2 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	websocket-extensions (ruby)	before 0.1.5	0.1.5	Patch available	CNA
—	websocket-extensions (RubyGems)	before 0.1.5	0.1.5	Patch available	GHSA-g6wq-qcwm-j5g2

websocket-extensions (ruby) Vendor— Affected before 0.1.5 Fixed in 0.1.5 Patch available CNA
websocket-extensions (RubyGems) Vendor— Affected before 0.1.5 Fixed in 0.1.5 Patch available GHSA-g6wq-qcwm-j5g2

CPE configurations NVD · 5

CPE	Versions	Role	Vendor
cpe:2.3:a:websocket-extensions_project:websocket-extensions::::::ruby::*	before 0.1.5	Vulnerable	Websocket-extensions Project
cpe:2.3:o:debian:debian_linux:9.0:::::::*	9.0	Vulnerable	Debian
cpe:2.3:o:canonical:ubuntu_linux:16.04::::esm:::	16.04	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::	18.04	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:20.04::::lts:::	20.04	Vulnerable	Canonical

cpe:2.3:a:websocket-extensions_project:websocket-extensions:*:*:*:*:*:ruby:*:* Versions before 0.1.5 Vulnerable ·Websocket-extensions Project
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical

Remediation

Fix · CNA websocket-extensions (ruby) Fixed in 0.1.5
Fix · GHSA-g6wq-qcwm-j5g2 websocket-extensions (RubyGems) Fixed in 0.1.5 Advisory →

Red Hat 1 advisory

RHSA-2020:4366 Released 2020-10-27 · Red Hat rating Important
Satellite 6.8 release
- Red Hat Satellite 6.8 ansible-collection-redhat-satellite-1.3.0-1.el7sat, ansible-runner-1.4.6-1.el7ar, ansiblerole-foreman_scap_client-0.0.5-1.el7sat +47
- Red Hat Satellite Capsule 6.8 ansible-collection-redhat-satellite-1.3.0-1.el7sat, ansible-runner-1.4.6-1.el7ar, ansiblerole-foreman_scap_client-0.0.5-1.el7sat +47

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
CloudForms Management Engine 5	Affected	No fix planned: Out of support scope
Red Hat Satellite 6.8	Fixed	RHSA-2020:4366
Red Hat Satellite Capsule 6.8	Fixed	RHSA-2020:4366

Timeline

2026-10-02 Threatist record created from CVE-2020-7663
2026-10-03 Alias added: GHSA-g6wq-qcwm-j5g2

References

Patch 1

https://github.com/faye/websocket-extensions-ruby/commit/aa156a439da681361ed6f53f1a8131892418838b

Advisory 5

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences