p PatchFirst

CVE-2025-6442

CVE-2025-6442 · Ruby WEBrick read_header HTTP Request Smuggling Vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions. The specific flaw exists within the read_headers method. The issue results from the inconsistent parsing of terminators of HTTP headers. An attacker can leverage this vulnerability to smuggle arbitrary HTTP requests. Was ZDI-CAN-21876.

CVSS 6.5 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • webrick

    Versions
    • 1.8.1: Affected

    No fix published

  • ruby-webrick Debian:12

    Versions
    • 1.8.1-1
    • 1.9.1-1
    • 1.9.2-1
    • 1.9.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-webrick Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.9.1-1

    Update to 1.9.1-1

  • ruby-webrick Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.9.1-1

    Update to 1.9.1-1

  • jruby Ubuntu:Pro:14.04:LTS

    Versions
    • 1.5.6-5ubuntu1
    • 1.5.6-6
    • 1.5.6-7
    • 1.5.6-9+deb8u2build0.14.04.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby2.3 Ubuntu:Pro:16.04:LTS

    Versions
    • 2.3.0-1
    • 2.3.0-2
    • 2.3.0-4ubuntu2
    • 2.3.0-4ubuntu3
    • 2.3.0-5ubuntu1
    • 2.3.1-2~16.04
    • 2.3.1-2~16.04.2
    • 2.3.1-2~16.04.4
    • 2.3.1-2~16.04.5
    • 2.3.1-2~16.04.6
    • 2.3.1-2~16.04.7
    • 2.3.1-2~16.04.9
    • 2.3.1-2~16.04.10
    • 2.3.1-2~16.04.11
    • 2.3.1-2~16.04.12
    • 2.3.1-2~ubuntu16.04.13
    • 2.3.1-2~ubuntu16.04.14
    • 2.3.1-2~ubuntu16.04.15
    • 2.3.1-2~ubuntu16.04.16
    • 2.3.1-2~ubuntu16.04.16+esm1
    • 2.3.1-2~ubuntu16.04.16+esm2
    • 2.3.1-2~ubuntu16.04.16+esm3
    • 2.3.1-2~ubuntu16.04.16+esm4
    • 2.3.1-2~ubuntu16.04.16+esm5
    • 2.3.1-2~ubuntu16.04.16+esm6
    • 2.3.1-2~ubuntu16.04.16+esm7
    • 2.3.1-2~ubuntu16.04.16+esm8
    • 2.3.1-2~ubuntu16.04.16+esm9
    • 2.3.1-2~ubuntu16.04.16+esm10
    Affected ranges
    • ECOSYSTEM: < 2.3.1-2~ubuntu16.04.16+esm11

    Update to 2.3.1-2~ubuntu16.04.16+esm11

  • jruby Ubuntu:16.04:LTS

    Versions
    • 1.7.21-2ubuntu4
    • 1.7.22-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby2.5 Ubuntu:Pro:18.04:LTS

    Versions
    • 2.5.0~preview1-1ubuntu2
    • 2.5.0-4ubuntu1
    • 2.5.0-4ubuntu4
    • 2.5.0-5ubuntu1
    • 2.5.0-6ubuntu1
    • 2.5.1-1ubuntu1
    • 2.5.1-1ubuntu1.1
    • 2.5.1-1ubuntu1.2
    • 2.5.1-1ubuntu1.4
    • 2.5.1-1ubuntu1.5
    • 2.5.1-1ubuntu1.6
    • 2.5.1-1ubuntu1.7
    • 2.5.1-1ubuntu1.8
    • 2.5.1-1ubuntu1.9
    • 2.5.1-1ubuntu1.10
    • 2.5.1-1ubuntu1.11
    • 2.5.1-1ubuntu1.12
    • 2.5.1-1ubuntu1.13
    • 2.5.1-1ubuntu1.14
    • 2.5.1-1ubuntu1.15
    • 2.5.1-1ubuntu1.16
    • 2.5.1-1ubuntu1.16+esm1
    • 2.5.1-1ubuntu1.16+esm3
    • 2.5.1-1ubuntu1.16+esm4
    • 2.5.1-1ubuntu1.16+esm5
    Affected ranges
    • ECOSYSTEM: < 2.5.1-1ubuntu1.16+esm6

    Update to 2.5.1-1ubuntu1.16+esm6

  • jruby Ubuntu:18.04:LTS

    Versions
    • 9.1.13.0-1
    • 9.1.17.0-1~18.04
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby2.7 Ubuntu:Pro:20.04:LTS

    Versions
    • 2.7.0-1
    • 2.7.0-2
    • 2.7.0-3
    • 2.7.0-4
    • 2.7.0-4ubuntu1
    • 2.7.0-5ubuntu1
    • 2.7.0-5ubuntu1.1
    • 2.7.0-5ubuntu1.2
    • 2.7.0-5ubuntu1.3
    • 2.7.0-5ubuntu1.4
    • 2.7.0-5ubuntu1.5
    • 2.7.0-5ubuntu1.6
    • 2.7.0-5ubuntu1.7
    • 2.7.0-5ubuntu1.8
    • 2.7.0-5ubuntu1.9
    • 2.7.0-5ubuntu1.10
    • 2.7.0-5ubuntu1.11
    • 2.7.0-5ubuntu1.12
    • 2.7.0-5ubuntu1.13
    • 2.7.0-5ubuntu1.14
    • 2.7.0-5ubuntu1.15
    • 2.7.0-5ubuntu1.16
    • 2.7.0-5ubuntu1.17
    • 2.7.0-5ubuntu1.18
    • 2.7.0-5ubuntu1.18+esm1
    Affected ranges
    • ECOSYSTEM: < 2.7.0-5ubuntu1.18+esm3

    Update to 2.7.0-5ubuntu1.18+esm3

  • jruby Ubuntu:20.04:LTS

    Versions
    • 9.1.17.0-3
    • 9.1.17.0-3build5
    • 9.1.17.0-3build6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-webrick Ubuntu:22.04:LTS

    Versions
    • 1.7.0-1
    • 1.7.0-2
    • 1.7.0-3
    • 1.7.0-3ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 1.7.0-3ubuntu0.2

    Update to 1.7.0-3ubuntu0.2

  • ruby-webrick Ubuntu:24.04:LTS

    Versions
    • 1.8.1-1
    • 1.8.1-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 1.8.1-1ubuntu0.2

    Update to 1.8.1-1ubuntu0.2

  • ruby-webrick Ubuntu:25.10

    Versions
    • 1.8.1-1ubuntu1
    Affected ranges
    • ECOSYSTEM: < 1.9.1-1

    Update to 1.9.1-1

  • ruby-webrick Ubuntu:26.04:LTS

    Affected ranges
    • ECOSYSTEM: < 1.9.1-1

    Update to 1.9.1-1

Original sources

Check your server →