CVE-2025-68696: httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-12-23 · updated 2026-10-19
Weakness: CWE-918

Description

httparty is an API tool. In versions 0.23.2 and prior, httparty is vulnerable to SSRF. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. This issue has been patched via commit 0529bcd.

Affected products

jnunemaker httparty: before 0.24.0 — fixed in 0.24.0

How to fix

Upgrade to a fixed version: jnunemaker httparty 0.24.0. Check the vendor advisory for mitigations.

References

https://github.com/jnunemaker/httparty/commit/0529bcd6309c9fd9bfdd50ae211843b10054c240
https://github.com/jnunemaker/httparty/security/advisories/GHSA-hm5p-x4rq-38w4
https://github.com/jnunemaker/httparty/security/advisories/GHSA-hm5p-x4rq-38w4

Get alerted when CVE-2025-68696 or the next vulnerability affects your stack