Vulnerability · Published Jun 25, 2025 · Assigned by zdi
CVE-2025-6442Ruby WEBrick read_header HTTP Request Smuggling Vulnerability
Medium 6.5
In plain English
A medium-severity security flaw in WEBrick from Ruby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions. The specific flaw exists within the read_headers method. The issue results from the inconsistent parsing of terminators of HTTP headers. An attacker can leverage this vulnerability to smuggle arbitrary HTTP requests. Was ZDI-CAN-21876.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ruby-webrick | no fix listed | DEBIAN-CVE-2025-6442 |
| Debian:13 | ruby-webrick | 1.9.1-1 | DEBIAN-CVE-2025-6442 |
| Debian:14 | ruby-webrick | 1.9.1-1 | DEBIAN-CVE-2025-6442 |
| RubyGems | webrick | 1.8.2 | GHSA-r995-q44h-hr64 |
| Ubuntu:22.04:LTS | ruby-webrick | 1.7.0-3ubuntu0.2 | UBUNTU-CVE-2025-6442 |
| Ubuntu:22.04:LTS | ruby-webrick | 1.7.0-3ubuntu0.2 | USN-7709-1 |
| Ubuntu:24.04:LTS | ruby-webrick | 1.8.1-1ubuntu0.2 | USN-7709-1 |
| Ubuntu:24.04:LTS | ruby-webrick | 1.8.1-1ubuntu0.2 | UBUNTU-CVE-2025-6442 |
| Ubuntu:25.10 | ruby-webrick | 1.9.1-1 | UBUNTU-CVE-2025-6442 |
| Ubuntu:26.04:LTS | ruby-webrick | 1.9.1-1 | UBUNTU-CVE-2025-6442 |
Affected products (as reported)
Weakness: CWE-444 · Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
References
- ZDI-25-414 x_research-advisory
- vendor-provided URL vendor-advisory