What’s Vulnerable › Vulnerabilities

CVE-2025-6442: Ruby WEBrick read_header HTTP Request Smuggling Vulnerability

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-25 · updated 2026-06-17
• Weakness: CWE-444

Description

Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions. The specific flaw exists within the read_headers method. The issue results from the inconsistent parsing of terminators of HTTP headers. An attacker can leverage this vulnerability to smuggle arbitrary HTTP requests. Was ZDI-CAN-21876.

Affected products

• Ruby WEBrick: before 1.8.2 — fixed in 1.8.2

How to fix

Upgrade to a fixed version: Ruby WEBrick 1.8.2. Check the vendor advisory for mitigations.

References

• https://github.com/ruby/webrick/commit/ee60354bcb84ec33b9245e1d1aa6e1f7e8132101#diff-ad02984d873efb089aa51551bc6b7d307a53e0ba1ac439e91d69c2e58a478864
• https://www.zerodayinitiative.com/advisories/ZDI-25-414/

Get alerted when CVE-2025-6442 or the next vulnerability affects your stack