Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mysql2-docUpgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade rubygem-mongo-docUpgrade rubygem-bsonUpgrade rubygem-mongoUpgrade rubygem-abrtUpgrade rubygem-bson-docUpgrade rubygem-mysql2Upgrade rubygem-pg-doc | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-rakeUpgrade rubygem-test-unitUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-net-telnetUpgrade rubygems-develUpgrade ruby-libsUpgrade rubygem-xmlrpcUpgrade ruby-debuginfoUpgrade rubygem-psychUpgrade rubygem-minitestUpgrade rubygem-opensslUpgrade rubygem-jsonUpgrade ruby-tcltkUpgrade rubygem-did_you_meanUpgrade rubyUpgrade rubygem-irbUpgrade rubygemsUpgrade rubygem-rdocUpgrade ruby-develUpgrade ruby-docUpgrade ruby-irbUpgrade rubygem-bundlerUpgrade rubygem-power_assert | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade rubygem-bsonUpgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade rubygem-jsonUpgrade rubyUpgrade rubygem-opensslUpgrade ruby-develUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-bundler-docUpgrade rubygem-minitestUpgrade rubygem-io-console-debuginfoUpgrade rubygemsUpgrade rubygem-mysql2Upgrade ruby-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-net-telnetUpgrade rubygem-pgUpgrade rubygem-abrtUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-rdocUpgrade rubygem-psych-debuginfoUpgrade ruby-libsUpgrade rubygem-irbUpgrade rubygem-mongoUpgrade rubygem-bundlerUpgrade rubygem-mysql2-docUpgrade rubygem-bson-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bson-docUpgrade rubygem-psychUpgrade rubygem-bson-debuginfoUpgrade rubygem-abrt-docUpgrade ruby-debugsourceUpgrade rubygem-mongo-docUpgrade rubygem-bigdecimalUpgrade rubygem-xmlrpcUpgrade rubygem-test-unitUpgrade rubygem-json-debuginfoUpgrade ruby-irbUpgrade rubygem-did_you_meanUpgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade rubygem-pg-debuginfo | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade jruby | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Feb 24, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade rubygem-test-unitUpgrade rubygem-bson-docUpgrade rubygem-rdocUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2-docUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygem-abrt-docUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-xmlrpcUpgrade ruby-libsUpgrade rubygem-bsonUpgrade rubygem-mysql2Upgrade rubygem-opensslUpgrade rubygem-pg-docUpgrade rubygem-jsonUpgrade rubygem-bundler-docUpgrade rubygem-irbUpgrade rubygemsUpgrade rubygem-mongo-docUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade rubygem-abrtUpgrade ruby-irbUpgrade rubygem-mongoUpgrade rubygem-bundlerUpgrade rubygem-psychUpgrade rubygem-net-telnetUpgrade ruby-develUpgrade rubygem-pgUpgrade ruby-docUpgrade ruby | Jul 2, 2021 | Oct 25, 2019 |
| Redhat_linux | — | Upgrade rubygem-bigdecimalUpgrade ruby-irbUpgrade rubygem-bson-docUpgrade rubygem-io-consoleUpgrade ruby-debugsourceUpgrade rubygem-jsonUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-mysql2-debugsourceUpgrade ruby-docUpgrade rubygem-mongo-docUpgrade rubygem-bson-debugsourceUpgrade rubygem-pg-docUpgrade rubygem-rakeUpgrade ruby-libsUpgrade rubygem-pg-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-bson-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-develUpgrade rubygem-test-unitUpgrade rubygem-pg-debugsourceUpgrade rubygem-rdocUpgrade rubygem-mongoUpgrade rubygem-irbUpgrade rubygem-bundler-docUpgrade rubygems-develUpgrade rubygem-pgUpgrade ruby-debuginfoUpgrade rubygem-bsonUpgrade rubygem-power_assertNo solution existsUpgrade rubygem-abrt-docUpgrade ruby-libs-debuginfoUpgrade rubygem-psychUpgrade rubygem-psych-debuginfoUpgrade rubyUpgrade rubygemsUpgrade rubygem-mysql2-docUpgrade rubygem-xmlrpcUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-opensslUpgrade rubygem-io-console-debuginfoUpgrade rubygem-abrtUpgrade rubygem-bundlerUpgrade rubygem-minitestUpgrade rubygem-net-telnet | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade rubygem-mysql2Upgrade ruby-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-bson-debugsourceUpgrade ruby-develUpgrade rubygem-psychUpgrade rubygem-pgUpgrade rubygem-bson-debuginfoUpgrade rubygem-bsonUpgrade rubygem-pg-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade ruby-libsUpgrade rubyUpgrade rubygem-pg-debugsourceUpgrade rubygem-jsonUpgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-psych-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-opensslUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mysql2-debugsource | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade ruby2.1Upgrade ruby2.1-develUpgrade ruby2.5-doc-riUpgrade yast2-ruby-bindingsUpgrade ruby2.5-devel-extraUpgrade libruby2_1-2_1Upgrade ruby2.5Upgrade ruby2.1-stdlibUpgrade ruby2.5-docUpgrade ruby2.5-stdlibUpgrade ruby2.5-develUpgrade libruby2_5-2_5 | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade libruby2.5Upgrade ruby2.3Upgrade ruby2.5Upgrade libruby2.3 | Nov 27, 2019 | Oct 1, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub