6.5

CVSS Score

3.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-6442

CVE-2025-6442: Ruby WEBrick read_headers method can lead to HTTP Request/Response Smuggling

Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions.

The specific flaw exists within the read_headers method. The issue results from the inconsistent parsing of terminators of HTTP headers. An attacker can leverage this vulnerability to smuggle arbitrary HTTP requests. Was ZDI-CAN-21876.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-6442

CVE-2025-6442:

6.5

CVSS Score

3.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
webrick	rubygems	< 1.8.2	1.8.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists due to inconsistent parsing of HTTP request line and header terminators in the WEBrick library. The core of the issue lies in the fact that WEBrick was more lenient than many proxy servers, accepting a lone Line Feed (LF) as a terminator in addition to the standard Carriage Return Line Feed (CRLF). An attacker could exploit this by crafting a request where the proxy server sees one request (ending in CRLF) while WEBrick, processing the same byte stream, sees two separate requests because it treats a subsequent LF as a delimiter.

The patch addresses this by enforcing stricter adherence to RFC standards. The key changes are in WEBrick::HTTPRequest#read_header and WEBrick::HTTPRequest#read_request_line, where the regular expressions are modified to exclusively accept CRLF (\r\n) as the line terminator. Additionally, WEBrick::HTTPUtils.parse_header was updated to prevent forbidden characters (CR, LF, NUL) within header values. These functions are the direct runtime indicators of the vulnerability, as they are responsible for the initial parsing of the malicious, smuggled HTTP request.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.