AIKIDO-2026-677195

TL;DR

The Server driver, created via WebSocket::Driver.server(), parses the incoming HTTP Host header into server name and port using URI parsing while completing the request. A client can send a malformed Host header that is not a valid host[:port] value, which raises an uncaught URI::InvalidURIError. Before the fix this exception propagates out of the request parser and can crash the server process, causing a denial of service when the application does not itself rescue the error. The fix makes the request parser rescue URI::InvalidURIError and put the request into an error state so the connection is treated as invalid instead of raising.