CVE catalog

CVE-2025-6442

WEBrick vulnerability

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.50% · Oct 25, 2026

Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions. The specific flaw exists within the read_headers method. The issue results from the inconsistent parsing of terminators of HTTP headers. An attacker can leverage this vulnerability to smuggle arbitrary HTTP requests. Was ZDI-CAN-21876.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-webricksid1.9.2-2fixed
Debianruby-webrickforky1.9.2-2fixed
Debianruby-webricktrixie1.9.1-1fixed
Debianruby-webrickbookworm1.8.1-1vulnerable
Ubunturuby-webricknobleNot reportedvulnerable
Ubunturuby-webricknoble1.8.1-1ubuntu0.2fixed
Ubuntujrubypro1.5.6-5ubuntu1vulnerable
Ubuntujrubypro1.5.6-6vulnerable
Ubuntujrubypro1.5.6-7vulnerable
Ubuntujrubypro1.5.6-9+deb8u2build0.14.04.1~esm2vulnerable
Ubunturuby2.3pro2.3.0-1vulnerable
Ubunturuby2.3pro2.3.0-2vulnerable
Ubunturuby2.3pro2.3.0-4ubuntu2vulnerable
Ubunturuby2.3pro2.3.0-4ubuntu3vulnerable
Ubunturuby2.3pro2.3.0-5ubuntu1vulnerable
Ubunturuby2.3pro2.3.1-2~16.04vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.2vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.4vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.5vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.6vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.7vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.9vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.10vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.11vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.12vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.13vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.14vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.15vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm1vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm2vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm3vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm4vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm5vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm6vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm7vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm8vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm9vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm10vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm11fixed
Ubuntujruby16.041.7.21-2ubuntu4vulnerable
Ubuntujruby16.041.7.22-1ubuntu1vulnerable
Ubunturuby2.5pro2.5.0~preview1-1ubuntu2vulnerable
Ubunturuby2.5pro2.5.0-4ubuntu1vulnerable
Ubunturuby2.5pro2.5.0-4ubuntu4vulnerable
Ubunturuby2.5pro2.5.0-5ubuntu1vulnerable
Ubunturuby2.5pro2.5.0-6ubuntu1vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.1vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.2vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.4vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.5vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.6vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.7vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.8vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.9vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.10vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.11vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.12vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.13vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.14vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.15vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.16vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.16+esm1vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.16+esm3vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.16+esm4vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.16+esm5vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.16+esm6fixed
Ubuntujruby18.049.1.13.0-1vulnerable
Ubuntujruby18.049.1.17.0-1~18.04vulnerable
Ubunturuby2.7pro2.7.0-1vulnerable
Ubunturuby2.7pro2.7.0-2vulnerable
Ubunturuby2.7pro2.7.0-3vulnerable
Ubunturuby2.7pro2.7.0-4vulnerable
Ubunturuby2.7pro2.7.0-4ubuntu1vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.1vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.2vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.3vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.4vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.5vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.6vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.7vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.8vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.9vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.10vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.11vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.12vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.13vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.14vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.15vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.16vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.17vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.18vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.18+esm1vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.18+esm3fixed
Ubuntujruby20.049.1.17.0-3vulnerable
Ubuntujruby20.049.1.17.0-3build5vulnerable
Ubuntujruby20.049.1.17.0-3build6vulnerable
Ubunturuby-webrick22.041.7.0-1vulnerable
Ubunturuby-webrick22.041.7.0-2vulnerable
Ubunturuby-webrick22.041.7.0-3vulnerable
Ubunturuby-webrick22.041.7.0-3ubuntu0.1vulnerable
Ubunturuby-webrick22.041.7.0-3ubuntu0.2fixed
Ubunturuby-webrick24.041.8.1-1vulnerable
Ubunturuby-webrick24.041.8.1-1ubuntu0.1vulnerable
Ubunturuby-webrick24.041.8.1-1ubuntu0.2fixed
Ubunturuby-webrick25.101.8.1-1ubuntu1vulnerable
Ubunturuby-webrick25.101.9.1-1fixed
Ubunturuby-webrick26.041.9.1-1fixed
Ubunturuby-webrick22.041.7.0-1vulnerable
Ubunturuby-webrick22.041.7.0-2vulnerable
Ubunturuby-webrick22.041.7.0-3vulnerable
Ubunturuby-webrick22.041.7.0-3ubuntu0.1vulnerable
Ubunturuby-webrick22.041.7.0-3ubuntu0.2fixed
Ubunturuby-webrick24.041.8.1-1vulnerable
Ubunturuby-webrick24.041.8.1-1ubuntu0.1vulnerable
Ubunturuby-webrick24.041.8.1-1ubuntu0.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-webricksourcesid1.9.1-1not yet assignedNot reportedNot reported
Debianruby-webricksourceforky1.9.1-1not yet assignedNot reportedNot reported
Debianruby-webricksourcetrixie1.9.1-1not yet assignedNot reportedNot reported
Debianruby-webricksourcebookworm(unfixed)not yet assignedNot reportedNot reported
Ubunturuby-webrickdebnoble1.8.1-1ubuntu0.2Not reportedNot reportedNot reported
Ubunturuby2.3debpro2.3.1-2~ubuntu16.04.16+esm11Not reportedUBUNTU-CVE-2025-6442Not reported
Ubunturuby2.5debpro2.5.1-1ubuntu1.16+esm6Not reportedUBUNTU-CVE-2025-6442Not reported
Ubunturuby2.7debpro2.7.0-5ubuntu1.18+esm3Not reportedUBUNTU-CVE-2025-6442Not reported
Ubunturuby-webrickdeb22.041.7.0-3ubuntu0.2Not reportedUBUNTU-CVE-2025-6442Not reported
Ubunturuby-webrickdeb24.041.8.1-1ubuntu0.2Not reportedUBUNTU-CVE-2025-6442Not reported
Ubunturuby-webrickdeb25.101.9.1-1Not reportedUBUNTU-CVE-2025-6442Not reported
Ubunturuby-webrickdeb26.041.9.1-1Not reportedUBUNTU-CVE-2025-6442Not reported
Ubunturuby-webrickdeb22.041.7.0-3ubuntu0.2Not reportedUSN-7709-1Not reported
Ubunturuby-webrickdeb24.041.8.1-1ubuntu0.2Not reportedUSN-7709-1Not reported

Notes

[bookworm] ruby-webrick: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ruby-webrick]Affected
    Details (2)

    • 1.8.1-1 · all · bookworm

      Affected

      usn · ruby-webrick · debian · bookworm; usn · ruby-webrick · debian · 12

    • 1.8.1-1 · all · bookworm

      Affected

      usn · ruby-webrick · debian · bookworm; usn · ruby-webrick · debian · 12

[Debian 13 (Trixie)]

  • [ruby-webrick]Fixed
    Details (2)

    • 1.9.1-1 · all · trixie

      Fixed · Fixed: 1.9.1-1

      usn · ruby-webrick · debian · 13

    • 1.9.1-1 · all · trixie

      Fixed · Fixed: 1.9.1-1

      usn · ruby-webrick · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]