A high-severity denial of service vulnerability in the faye websocket-driver-ruby library could allow an unauthenticated attacker to crash the application.

The library is susceptible to an uncaught exception (CWE-248) during WebSocket protocol handling. This flaw is remotely exploitable without authentication, potentially causing the application to hang or terminate unexpectedly.

The primary impact of this vulnerability is service availability. With a CVSS score of 8.9, the ability for an unauthenticated attacker to remotely trigger a crash presents a significant threat to business continuity, particularly for services heavily dependent on WebSocket communication.

Immediate Action: Update the faye websocket-driver-ruby dependency to version 0.8.2 or later in your project's Gemfile.

Proactive Monitoring: Monitor application logs for recurring stack traces or sudden service restarts that may indicate attempted exploitation of this exception-based vulnerability.

Compensating Controls: Utilize a robust load balancer or ingress controller to manage traffic and potentially mitigate the impact of service-level disruptions.

Public Exploit Available: No

Due to the high CVSS score and the ease of remote exploitation, developers should prioritize upgrading the websocket-driver-ruby library to version 0.8.2 immediately to prevent potential service-disruption attacks.