Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions.
The specific flaw exists within the read_headers method. The issue results from the inconsistent parsing of terminators of HTTP headers. An attacker can leverage this vulnerability to smuggle arbitrary HTTP requests. Was ZDI-CAN-21876.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
- CVSS 3.0 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade rubyUpgrade rubygemsUpgrade ruby-tcltkUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygem-psychUpgrade rubygems-develUpgrade ruby-debuginfoUpgrade rubygem-minitestUpgrade rubygem-rakeUpgrade rubygem-rdocUpgrade ruby-irbUpgrade ruby-devel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade ruby3.2Upgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-libsUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-io-console | Jul 30, 2025 | Jun 25, 2025 |
| Apple Osx Ruby | — | Upgrade macOS to the latest version | Nov 4, 2025 | Nov 4, 2025 |
| Debian | — | Upgrade ruby-webrickNo solution exists | Jun 27, 2025 | Jun 25, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubygemsUpgrade rubygem-jsonUpgrade rubygem-rdocUpgrade rubyUpgrade rubygem-opensslUpgrade rubygem-psychUpgrade ruby-irbUpgrade ruby-helpUpgrade rubygem-did_you_meanUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimal | Nov 12, 2025 | Nov 6, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 25, 2025 |
| Suse | — | Upgrade libruby2_5-2_5Upgrade ruby2.5-devel-extraUpgrade ruby2.5Upgrade ruby2.5-doc-riUpgrade ruby2.5-docUpgrade ruby2.5-stdlibUpgrade ruby2.5-devel | Aug 14, 2025 | Aug 8, 2025 |
| Ubuntu | — | Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby-webrickUpgrade libruby2.5 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby2.7 (Ubuntu Pro) | Aug 4, 2025 | Jun 25, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 11, 2025 | Jun 25, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub