Missing TLS certificate verification in Faye Websocket
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-295.
Summary
In faye-websocket before version 0.11.0, there is a lack of certification validation in TLS handshakes. The `Faye::WebSocket::Client` class uses the `EM::Connection#start_tls` method in EventMachine to implement the TLS handshake whenever a `wss:` URL is used for the connection. This method does not implement certificate verification by default, meaning that it does not check that the server presents a valid and trusted TLS certificate for the expected hostname. That means that any `wss:` connection made using this library is vulnerable to a man-in-the-middle attack, since it does not confirm the identity of the server it is connected to. For further background information on this issue, please see the referenced GitHub Advisory. Upgrading `faye-websocket` to v0.11.0 is recommended.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| faye | faye-websocket | before 0.11.0 | 0.11.0 | Patch available | CNA |
| — | faye-websocket (RubyGems) | before 0.11.0 | 0.11.0 | Patch available | GHSA-2v5c-755p-p4gv |
- faye-websocket Vendorfaye Affected before 0.11.0 Fixed in 0.11.0 Patch available CNA
- faye-websocket (RubyGems) Vendor— Affected before 0.11.0 Fixed in 0.11.0 Patch available GHSA-2v5c-755p-p4gv
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:faye-websocket_project:faye-websocket:*:*:*:*:*:*:*:* | before 0.11.0 | Vulnerable | Faye-websocket Project |
- cpe:2.3:a:faye-websocket_project:faye-websocket:*:*:*:*:*:*:*:* Versions before 0.11.0 Vulnerable ·Faye-websocket Project
Remediation
- Fix · CNA faye-websocket (faye) Fixed in 0.11.0
- Fix · GHSA-2v5c-755p-p4gv faye-websocket (RubyGems) Fixed in 0.11.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15133
- 2026-10-03 Alias added: GHSA-2v5c-755p-p4gv
- 2026-10-24 Priority changed: MEDIUM → LOW
References
Exploit 2
Advisory 2
Other 11
- https://github.com/eventmachine/eventmachine/issues/275
- https://github.com/eventmachine/eventmachine/issues/814
- https://github.com/faye/faye/issues/524
- https://github.com/eventmachine/eventmachine/pull/378
- https://github.com/faye/faye-websocket-ruby/pull/129
- https://github.com/igrigorik/em-http-request/pull/340
- https://blog.jcoglan.com/2020/07/31/missing-tls-verification-in-faye
- https://github.com/faye/faye-websocket-ruby
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/faye-websocket/CVE-2020-15133.yml
- https://www.rubydoc.info/github/eventmachine/eventmachine/EventMachine/Connection:ssl_verify_peer
- https://www.rubydoc.info/github/eventmachine/eventmachine/EventMachine/Connection:start_tls
More faye vulnerabilities
- TI-2026-39323 websocket-driver: Message corruption via abuse of protocol length headers CVSS 4.0CRITICAL 9.2
- TI-2020-08894 Authentication and extension bypass in Faye CVSS 3.1CRITICAL 9.8
- TI-2026-44153 websocket-driver: Denial of service via malformed Host header CVSS 4.0HIGH 8.9
- TI-2020-11907 Missing TLS certificate verification in Faye CVSS 3.1HIGH 8.7
- TI-2026-39320 websocket-driver: Memory exhaustion via abuse of protocol length headers CVSS 4.0MEDIUM 6.9
- TI-2026-39336 websocket-driver: Resource limit bypass via message compression CVSS 4.0MEDIUM 6.3
Sources
- CVE-2020-15133 · CVE Program
- CVE-2020-15133 · NVD
- FIRST EPSS
- GHSA-2v5c-755p-p4gv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences