websocket-driver: Message corruption via abuse of protocol length headers

Description

The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server parse these bytes into an ever-growing integer.

Recommendation

Update the websocket-driver package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.7.5
• Patched version(s): 0.7.5

References

• GHSA-xv26-6w52-cph6
• CVE-2026-54466
• CWE-130
• CAPEC-310
• OWASP 2021-A6