CVE-2020-7663

CVE-2020-7663 describes a Denial of Service (DoS) vulnerability in the websocket-extensions Ruby module prior to version 0.1.5, affecting various Linux distributions and the websocket-extensions project itself. The vulnerability stems from a Regex Backtracking issue, where a specially crafted Sec-WebSocket-Extensions header can cause quadratic parsing time, leading to a ReDoS attack on single-threaded servers. This is a high-severity vulnerability (CVSS 7.5) with a low attack complexity and no user interaction required, allowing an unauthenticated attacker to achieve a complete denial of service. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has received some community discussion and media coverage, including a mention in a GitLab security release.