CVE catalog

CVE-2020-7663

ruby-websocket-extensions: CVE-2020-7663

[CVE catalog]

Severity
Medium · CVSS 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
4.64% · Oct 25, 2026

websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-websocket-extensionssid0.1.5-2fixed
Debianruby-websocket-extensionsforky0.1.5-2fixed
Debianruby-websocket-extensionstrixie0.1.5-2fixed
Debianruby-websocket-extensionsbookworm0.1.5-2fixed
Opensuserubygem-websocket-extensionstumbleweed0.1.5-1.24fixed
Ubunturuby-websocket-extensions16.040.1.2-1vulnerable
Ubunturuby-websocket-extensions16.040.1.2-1+deb9u1build0.16.04.1fixed
Ubunturuby-websocket-extensions18.040.1.2-1vulnerable
Ubunturuby-websocket-extensions18.040.1.2-1+deb9u1build0.18.04.1fixed
Ubunturuby-websocket-extensions20.040.1.2-1vulnerable
Ubunturuby-websocket-extensions20.040.1.2-1+deb9u1build0.20.04.1fixed
Opensuserubygem-websocket-extensionstumbleweed0.1.5-1.22fixed
Ubunturuby-websocket-extensions16.040.1.2-1vulnerable
Ubunturuby-websocket-extensions16.040.1.2-1+deb9u1build0.16.04.1fixed
Ubunturuby-websocket-extensions18.040.1.2-1vulnerable
Ubunturuby-websocket-extensions18.040.1.2-1+deb9u1build0.18.04.1fixed
Ubunturuby-websocket-extensions20.040.1.2-1vulnerable
Ubunturuby-websocket-extensions20.040.1.2-1+deb9u1build0.20.04.1fixed
Opensuserubygem-websocket-extensionstumbleweed0.1.5-1.20fixed
Suserubygem-websocket-extensionslinux enterprise high availability extension 15 sp10.1.3-150000.3.4.1fixed
Suserubygem-websocket-extensionslinux enterprise high availability extension 15 sp20.1.3-150000.3.4.1fixed
Suserubygem-websocket-extensionslinux enterprise high availability extension 15 sp30.1.3-150000.3.4.1fixed
Suserubygem-websocket-extensionslinux enterprise high availability extension 15 sp40.1.3-150000.3.4.1fixed
Opensuserubygem-websocket-extensionsleap 15.40.1.3-150000.3.4.1fixed
Opensuseruby3.2-rubygem-websocket-extensionstumbleweed0.1.5-1.16fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-websocket-extensionssourcesid0.1.5-1not yet assignedNot reported[964274]
Debianruby-websocket-extensionssourceforky0.1.5-1not yet assignedNot reported[964274]
Debianruby-websocket-extensionssourcetrixie0.1.5-1not yet assignedNot reported[964274]
Debianruby-websocket-extensionssourcebookworm0.1.5-1not yet assignedNot reported[964274]
Opensuserubygem-websocket-extensionsrpmtumbleweed0.1.5-1.24Not reportedOPENSUSE-SU-2026:10368-1Not reported
Ubunturuby-websocket-extensionsdeb16.040.1.2-1+deb9u1build0.16.04.1Not reportedUSN-4502-1Not reported
Ubunturuby-websocket-extensionsdeb18.040.1.2-1+deb9u1build0.18.04.1Not reportedUSN-4502-1Not reported
Ubunturuby-websocket-extensionsdeb20.040.1.2-1+deb9u1build0.20.04.1Not reportedUSN-4502-1Not reported
Opensuserubygem-websocket-extensionsrpmtumbleweed0.1.5-1.22Not reportedOPENSUSE-SU-2025:15130-1Not reported
Ubunturuby-websocket-extensionsdeb16.040.1.2-1+deb9u1build0.16.04.1Not reportedUBUNTU-CVE-2020-7663Not reported
Ubunturuby-websocket-extensionsdeb18.040.1.2-1+deb9u1build0.18.04.1Not reportedUBUNTU-CVE-2020-7663Not reported
Ubunturuby-websocket-extensionsdeb20.040.1.2-1+deb9u1build0.20.04.1Not reportedUBUNTU-CVE-2020-7663Not reported
Opensuserubygem-websocket-extensionsrpmtumbleweed0.1.5-1.20Not reportedOPENSUSE-SU-2024:14180-1Not reported
Suserubygem-websocket-extensionsrpmlinux enterprise high availability extension 15 sp10.1.3-150000.3.4.1Not reportedSUSE-SU-2023:0127-1Not reported
Suserubygem-websocket-extensionsrpmlinux enterprise high availability extension 15 sp20.1.3-150000.3.4.1Not reportedSUSE-SU-2023:0127-1Not reported
Suserubygem-websocket-extensionsrpmlinux enterprise high availability extension 15 sp30.1.3-150000.3.4.1Not reportedSUSE-SU-2023:0127-1Not reported
Suserubygem-websocket-extensionsrpmlinux enterprise high availability extension 15 sp40.1.3-150000.3.4.1Not reportedSUSE-SU-2023:0127-1Not reported
Opensuserubygem-websocket-extensionsrpmleap 15.40.1.3-150000.3.4.1Not reportedSUSE-SU-2023:0127-1Not reported
Opensuseruby3.2-rubygem-websocket-extensionsrpmtumbleweed0.1.5-1.16Not reportedOPENSUSE-SU-2024:13173-1Not reported

[Debian bug #964274]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[Debian 12 (Bookworm)]

  • [ruby-websocket-extensions]Fixed
    Details (2)

    • 0.1.5-2 · all · bookworm

      Fixed · Fixed: 0.1.5-1

      dsa · ruby-websocket-extensions · debian · bookworm; dsa · ruby-websocket-extensions · debian · 12

    • 0.1.5-2 · all · bookworm

      Fixed · Fixed: 0.1.5-1

      dsa · ruby-websocket-extensions · debian · bookworm; dsa · ruby-websocket-extensions · debian · 12

[Debian 13 (Trixie)]

  • [ruby-websocket-extensions]Fixed
    Details (2)

    • 0.1.5-2 · all · trixie

      Fixed · Fixed: 0.1.5-1

      dsa · ruby-websocket-extensions · debian · 13

    • 0.1.5-2 · all · trixie

      Fixed · Fixed: 0.1.5-1

      dsa · ruby-websocket-extensions · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]