HTTP Request Smuggling Vulnerability in Ruby WEBrick
CVE-2025-6442

5.9MEDIUM

Key Information:

Vendor

Ruby

Status
Webrick
Vendor
CVE Published:
25 June 2025

What is CVE-2025-6442?

A vulnerability exists within the Ruby WEBrick's read_headers method, which can lead to HTTP request smuggling when deployed in specific configurations behind an HTTP proxy. This vulnerability arises from inconsistent parsing of terminators in HTTP headers, enabling attackers to exploit the flaw and craft arbitrary HTTP requests. Such an attack could lead to further compromises or unauthorized actions within the affected installations of Ruby WEBrick.

Affected Version(s)

WEBrick 1.8.1

References

https://www.zerodayinitiative.com/advisories/ZDI-25-414/
x_research-advisory
https://github.com/ruby/webrick/commit/ee60354bcb84ec33b9...
vendor-advisory

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.