Skip to content

GHSA SYNC: 1 brand new advisory #879

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 28, 2025
Merged

GHSA SYNC: 1 brand new advisory #879

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions gems/webrick/CVE-2025-6442.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
---
gem: webrick
cve: 2025-6442
ghsa: r995-q44h-hr64
url: https://github.com/advisories/GHSA-r995-q44h-hr64
title: Ruby WEBrick read_headers method can lead to
HTTP Request/Response Smuggling
date: 2025-06-26
description: |
Ruby WEBrick read_header HTTP Request Smuggling Vulnerability

This vulnerability allows remote attackers to smuggle arbitrary HTTP
requests on affected installations of Ruby WEBrick. This issue is
exploitable when the product is deployed behind an HTTP proxy that
fulfills specific conditions.

The specific flaw exists within the read_headers method. The issue
results from the inconsistent parsing of terminators of HTTP headers.
An attacker can leverage this vulnerability to smuggle arbitrary
HTTP requests. Was ZDI-CAN-21876.
cvss_v3: 6.5
patched_versions:
- ">= 1.8.2"
related:
url:
- https://nvd.nist.gov/vuln/detail/CVE-2025-6442
- https://github.com/ruby/webrick/commit/ee60354bcb84ec33b9245e1d1aa6e1f7e8132101#diff-ad02984d873efb089aa51551bc6b7d307a53e0ba1ac439e91d69c2e58a478864
- https://www.zerodayinitiative.com/advisories/ZDI-25-414
- https://github.com/advisories/GHSA-r995-q44h-hr64