ByteOS Network

NVD Vulnerability Details :

CVE-2025-6442

Analyzed

Source-zdi-disclosures@trendmicro.com

Published At-25 Jun, 2025 | 17:15

Updated At-18 Aug, 2025 | 15:49

Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions. The specific flaw exists within the read_headers method. The issue results from the inconsistent parsing of terminators of HTTP headers. An attacker can leverage this vulnerability to smuggle arbitrary HTTP requests. Was ZDI-CAN-21876.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.9	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Secondary	3.0	6.5	MEDIUM	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

CPE Matches

Ruby

>>webrick>>Versions before 1.8.2(exclusive)

cpe:2.3:a:ruby-lang:webrick:*:*:*:*:*:ruby:*:*

Weaknesses

CWE ID	Type	Source
CWE-444	Primary	zdi-disclosures@trendmicro.com

References

Hyperlink	Source	Resource
https://github.com/ruby/webrick/commit/ee60354bcb84ec33b9245e1d1aa6e1f7e8132101#diff-ad02984d873efb089aa51551bc6b7d307a53e0ba1ac439e91d69c2e58a478864	zdi-disclosures@trendmicro.com	Patch
https://www.zerodayinitiative.com/advisories/ZDI-25-414/	zdi-disclosures@trendmicro.com	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History