CVE-2025-6442

Medium

Description

Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions. The specific flaw exists within the read_headers method. The issue results from the inconsistent parsing of terminators of HTTP headers. An attacker can leverage this vulnerability to smuggle arbitrary HTTP requests. Was ZDI-CAN-21876.

SeverityMedium

CVSS5.9

Exploit probability—

Product

Ruby-lang Webrick

PublishedJun 25, 2025

First seenJun 25, 2025

Weakness typeCWE-444CWE-444

How to fix

Update

ruby-lang webrick1.8.2 or later

Vendor advisories

github.com/ruby/webrick/commit/ee60354bcb84ec33b9245e1d1aa6e1f7e8132101#diff-ad02984d873efb089aa51551bc6b7d307a53e0ba1ac439e91d69c2e58a478864

Affected products

Product	Affected versions	Fixed in
ruby-lang webrick	v < 1.8.2	1.8.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.