Skip to content
Log inStart free trial

GHSA-gwfg-cqmg-cf8f BIT-ruby-2020-25613 BIT-ruby-min-2020-25613 CVE-2020-25613

WEBRick vulnerable to HTTP Request/Response Smuggling

High RubyGems
Severity
7.5 / 10
High · CVSS 3.1
Exploit chance (EPSS)
3.82%
Chance of exploitation in the next 30 days. Higher than 90.06% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Fix
1.6.1
Upgrade webrick to this version or later

Description

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

Affected versions

RubyGems

PackageVulnerableFixed in
webrick
>= 1.6.0, < 1.6.1
1.6.1
webrick
>= 1.5.0, < 1.5.1
1.5.1
webrick
< 1.4.4
1.4.4

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

webrick RubyGems → 1.6.1

bundler
bundle update webrick # Gemfile: gem "webrick", ">= 1.6.1"

Severity breakdown

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Weakness

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

How to prevent it
  • Implementation: Use a web server that employs a strict HTTP parsing procedure, such as Apache [REF-433].
  • Implementation: Use only SSL communication.
  • Implementation: Terminate the client session after each request.
  • System Configuration: Turn all pages to non-cacheable.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-r995-q44h-hr64
Ruby WEBrick read_headers method can lead to HTTP Request/Response Smuggling
Medium Also affects webrick
GHSA-6f62-3596-g6w7
HTTP Request Smuggling in ruby webrick
High Also affects webrick
GHSA-369m-2gv6-mw28
WEBrick RCE Vulnerability
High Also affects webrick
GHSA-wfrc-r6c6-7j9r
WEBrick Denial of Service Vulnerability
High Also affects webrick
GHSA-6mq2-37j5-w6r6
WEBrick Improper Input Validation vulnerability
Medium Also affects webrick
EEF-CVE-2026-114216
Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit
Not rated yet Same weakness, CWE-444
RUSTSEC-2026-0388
Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass
Not rated yet Same weakness, CWE-444
GHSA-pqxq-w44r-73xw
AIOHTTP: Pure-Python parser request smuggling
Medium Same weakness, CWE-444
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor