CVE-2025-6442 - CVE House
Back to Database
Status published Medium CVE-2025-6442

Ruby WEBrick read_header HTTP Request Smuggling Vulnerability

Vulnerability Description

Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions. The specific flaw exists within the read_headers method. The issue results from the inconsistent parsing of terminators of HTTP headers. An attacker can leverage this vulnerability to smuggle arbitrary HTTP requests. Was ZDI-CAN-21876.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-6442

Credits & Attribution

No credits recorded in the NVD database.

References

More from Ruby

View All →
CVE-2025-24294
The attack vector is a potential Denial of Service (DoS)....
Unknown 0
CVE-2016-2339
An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize"...
Critical 9.8
CVE-2016-2337
Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker...
Critical 9.8
CVE-2016-2336
Type confusion exists in two methods of Ruby's WIN32OLE class,...
Critical 9.8
CVE-2015-1855
verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel...
Medium 5.9

Affected Vendor

Affected Software

WEBrick
Vulnerable Versions:
1.8.1

Timeline

Official Publish: June 25th, 2025
Last Modified: June 25th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Weaknesses (CWE)

CWE-444

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1565.002 Stored Data Manipulation
Impact
T1078 Valid Accounts
Defense Evasion