Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/50471?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/50471?format=api", "purl": "pkg:gem/webrick@1.3.1", "type": "gem", "namespace": "", "name": "webrick", "version": "1.3.1", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "1.8.2", "latest_non_vulnerable_version": "1.8.2", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/13667?format=api", "vulnerability_id": "VCID-3wgz-s6g4-n3fk", "summary": "HTTP Request Smuggling in ruby webrick\nAn issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., \"GET /admin HTTP/1.1\\r\\n\" inside of a \"POST /user HTTP/1.1\\r\\n\" request. NOTE: the supplier's position is \"Webrick should not be used in production.\"", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-47220.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-47220.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-47220", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00108", "scoring_system": "epss", "scoring_elements": "0.28972", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00108", "scoring_system": "epss", "scoring_elements": "0.29018", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00108", "scoring_system": "epss", "scoring_elements": "0.29041", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00108", "scoring_system": "epss", "scoring_elements": "0.29015", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00108", "scoring_system": "epss", "scoring_elements": "0.29066", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00108", "scoring_system": "epss", "scoring_elements": "0.2911", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00108", "scoring_system": "epss", "scoring_elements": "0.29105", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00108", "scoring_system": "epss", "scoring_elements": "0.29062", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00108", "scoring_system": "epss", "scoring_elements": "0.28998", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00108", "scoring_system": "epss", "scoring_elements": "0.29189", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00108", "scoring_system": "epss", "scoring_elements": "0.29139", "published_at": "2026-04-02T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-47220" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/advisories/GHSA-6f62-3596-g6w7", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-6f62-3596-g6w7" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2024-47220.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2024-47220.yml" }, { "reference_url": "https://github.com/ruby/webrick", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/webrick" }, { "reference_url": "https://github.com/ruby/webrick/commit/f5faca9222541591e1a7c3c97552ebb0c92733c7", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/webrick/commit/f5faca9222541591e1a7c3c97552ebb0c92733c7" }, { "reference_url": "https://github.com/ruby/webrick/issues/145", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-23T15:01:28Z/" } ], "url": "https://github.com/ruby/webrick/issues/145" }, { "reference_url": "https://github.com/ruby/webrick/issues/145#issuecomment-2369994610", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-23T15:01:28Z/" } ], "url": "https://github.com/ruby/webrick/issues/145#issuecomment-2369994610" }, { "reference_url": "https://github.com/ruby/webrick/issues/145#issuecomment-2372838285", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-23T15:01:28Z/" } ], "url": "https://github.com/ruby/webrick/issues/145#issuecomment-2372838285" }, { "reference_url": "https://github.com/ruby/webrick/pull/146/commits/d88321da45dcd230ac2b4585cad4833d6d5e8841", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-23T15:01:28Z/" } ], "url": "https://github.com/ruby/webrick/pull/146/commits/d88321da45dcd230ac2b4585cad4833d6d5e8841" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47220", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47220" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1082633", "reference_id": "1082633", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1082633" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2314051", "reference_id": "2314051", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2314051" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:1227", "reference_id": "RHSA-2025:1227", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:1227" }, { "reference_url": "https://usn.ubuntu.com/7057-1/", "reference_id": "USN-7057-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7057-1/" }, { "reference_url": "https://usn.ubuntu.com/7057-2/", "reference_id": "USN-7057-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7057-2/" }, { "reference_url": "https://usn.ubuntu.com/7840-1/", "reference_id": "USN-7840-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7840-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/48587?format=api", "purl": "pkg:gem/webrick@1.8.2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/webrick@1.8.2" } ], "aliases": [ "CVE-2024-47220", "GHSA-6f62-3596-g6w7" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-3wgz-s6g4-n3fk" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/15467?format=api", "vulnerability_id": "VCID-91b7-xx8t-rqhr", "summary": "Improper Authentication\nThe Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.", "references": [ { "reference_url": "https://access.redhat.com/errata/RHSA-2017:3485", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://access.redhat.com/errata/RHSA-2017:3485" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2018:0378", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://access.redhat.com/errata/RHSA-2018:0378" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2018:0583", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://access.redhat.com/errata/RHSA-2018:0583" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2018:0585", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://access.redhat.com/errata/RHSA-2018:0585" }, { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-10784.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-10784.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-10784", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01385", "scoring_system": "epss", "scoring_elements": "0.8032", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.01385", "scoring_system": "epss", "scoring_elements": "0.80309", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.01385", "scoring_system": "epss", "scoring_elements": "0.80265", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.01385", "scoring_system": "epss", "scoring_elements": "0.80338", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.01385", "scoring_system": "epss", "scoring_elements": "0.80281", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.01385", "scoring_system": "epss", "scoring_elements": "0.80293", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.01385", "scoring_system": "epss", "scoring_elements": "0.80272", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.014", "scoring_system": "epss", "scoring_elements": "0.80425", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.014", "scoring_system": "epss", "scoring_elements": "0.80419", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.014", "scoring_system": "epss", "scoring_elements": "0.80448", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.016", "scoring_system": "epss", "scoring_elements": "0.81733", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.016", "scoring_system": "epss", "scoring_elements": "0.8173", "published_at": "2026-04-18T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-10784" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0898", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0898" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0903", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0903" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10784", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10784" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14033", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14033" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.4", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:L/Au:N/C:N/I:P/A:P" }, { "value": "5.4", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ruby/ruby/commit/6617c41292", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/ruby/commit/6617c41292" }, { "reference_url": "https://github.com/ruby/webrick", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/webrick" }, { "reference_url": "https://github.com/ruby/webrick/commit/4ac0f3843ab82d1c31e1cfc719409208adef7813", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/webrick/commit/4ac0f3843ab82d1c31e1cfc719409208adef7813" }, { "reference_url": "https://hackerone.com/reports/223363", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://hackerone.com/reports/223363" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html" }, { "reference_url": "https://security.gentoo.org/glsa/201710-18", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/201710-18" }, { "reference_url": "https://usn.ubuntu.com/3528-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/3528-1" }, { "reference_url": "https://usn.ubuntu.com/3528-1/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/3528-1/" }, { "reference_url": "https://usn.ubuntu.com/3685-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/3685-1" }, { "reference_url": "https://usn.ubuntu.com/3685-1/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/3685-1/" }, { "reference_url": "https://web.archive.org/web/20210621131814/http://www.securityfocus.com/bid/100853", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20210621131814/http://www.securityfocus.com/bid/100853" }, { "reference_url": "https://web.archive.org/web/20210919031115/http://www.securitytracker.com/id/1042004", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20210919031115/http://www.securitytracker.com/id/1042004" }, { "reference_url": "https://web.archive.org/web/20211025092552/http://www.securitytracker.com/id/1039363", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20211025092552/http://www.securitytracker.com/id/1039363" }, { "reference_url": "https://www.debian.org/security/2017/dsa-4031", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.debian.org/security/2017/dsa-4031" }, { "reference_url": "https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released" }, { "reference_url": "https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released/" }, { "reference_url": "https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released" }, { "reference_url": "https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released/" }, { "reference_url": "https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784" }, { "reference_url": "https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/" }, { "reference_url": "http://www.securityfocus.com/bid/100853", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.securityfocus.com/bid/100853" }, { "reference_url": "http://www.securitytracker.com/id/1039363", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.securitytracker.com/id/1039363" }, { "reference_url": "http://www.securitytracker.com/id/1042004", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.securitytracker.com/id/1042004" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1492012", "reference_id": "1492012", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1492012" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.3.0:*:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:ruby-lang:ruby:2.3.0:*:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.3.0:*:*:*:*:*:*:*" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.3.0:preview1:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:ruby-lang:ruby:2.3.0:preview1:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.3.0:preview1:*:*:*:*:*:*" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.3.0:preview2:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:ruby-lang:ruby:2.3.0:preview2:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.3.0:preview2:*:*:*:*:*:*" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.3.1:*:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:ruby-lang:ruby:2.3.1:*:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.3.1:*:*:*:*:*:*:*" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.3.2:*:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:ruby-lang:ruby:2.3.2:*:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.3.2:*:*:*:*:*:*:*" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.3.3:*:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:ruby-lang:ruby:2.3.3:*:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.3.3:*:*:*:*:*:*:*" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.3.4:*:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:ruby-lang:ruby:2.3.4:*:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.3.4:*:*:*:*:*:*:*" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.4.0:*:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:ruby-lang:ruby:2.4.0:*:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.4.0:*:*:*:*:*:*:*" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.4.0:preview1:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:ruby-lang:ruby:2.4.0:preview1:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.4.0:preview1:*:*:*:*:*:*" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.4.0:preview2:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:ruby-lang:ruby:2.4.0:preview2:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.4.0:preview2:*:*:*:*:*:*" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.4.0:preview3:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:ruby-lang:ruby:2.4.0:preview3:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.4.0:preview3:*:*:*:*:*:*" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.4.0:rc1:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:ruby-lang:ruby:2.4.0:rc1:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.4.0:rc1:*:*:*:*:*:*" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.4.1:*:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:ruby-lang:ruby:2.4.1:*:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.4.1:*:*:*:*:*:*:*" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10784", "reference_id": "CVE-2017-10784", "reference_type": "", "scores": [ { "value": "9.3", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:M/Au:N/C:C/I:C/A:C" }, { "value": "8.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10784" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2017-10784.yml", "reference_id": "CVE-2017-10784.YML", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2017-10784.yml" }, { "reference_url": "https://github.com/advisories/GHSA-369m-2gv6-mw28", "reference_id": "GHSA-369m-2gv6-mw28", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-369m-2gv6-mw28" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:7305", "reference_id": "RHSA-2026:7305", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:7305" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:7307", "reference_id": "RHSA-2026:7307", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:7307" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:8838", "reference_id": "RHSA-2026:8838", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:8838" }, { "reference_url": "https://usn.ubuntu.com/3439-1/", "reference_id": "USN-3439-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/3439-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/25135?format=api", "purl": "pkg:gem/webrick@1.4.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3wgz-s6g4-n3fk" }, { "vulnerability": "VCID-pay9-phaz-bbde" }, { "vulnerability": "VCID-vcz9-dvf4-47am" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/webrick@1.4.0" } ], "aliases": [ "CVE-2017-10784", "GHSA-369m-2gv6-mw28" ], "risk_score": 4.2, "exploitability": "0.5", "weighted_severity": "8.4", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-91b7-xx8t-rqhr" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8434?format=api", "vulnerability_id": "VCID-bv9s-j5yk-m3aw", "summary": "WEBrick Improper Input Validation vulnerability\nWEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-4492.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-4492.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2009-4492", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.17685", "scoring_system": "epss", "scoring_elements": "0.95076", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.17685", "scoring_system": "epss", "scoring_elements": "0.95123", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.17685", "scoring_system": "epss", "scoring_elements": "0.95121", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.17685", "scoring_system": "epss", "scoring_elements": "0.95118", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.17685", "scoring_system": "epss", "scoring_elements": "0.9511", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.17685", "scoring_system": "epss", "scoring_elements": "0.95107", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.17685", "scoring_system": "epss", "scoring_elements": "0.95105", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.17685", "scoring_system": "epss", "scoring_elements": "0.95099", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.17685", "scoring_system": "epss", "scoring_elements": "0.95096", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.17685", "scoring_system": "epss", "scoring_elements": "0.95089", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.17685", "scoring_system": "epss", "scoring_elements": "0.95087", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.17685", "scoring_system": "epss", "scoring_elements": "0.95086", "published_at": "2026-04-02T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2009-4492" }, { "reference_url": "https://github.com/ruby/webrick", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/webrick" }, { "reference_url": "https://web.archive.org/web/20100113155532/http://www.vupen.com/english/advisories/2010/0089", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20100113155532/http://www.vupen.com/english/advisories/2010/0089" }, { "reference_url": "https://web.archive.org/web/20100815010948/http://secunia.com/advisories/37949", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20100815010948/http://secunia.com/advisories/37949" }, { "reference_url": "https://web.archive.org/web/20170402100552/http://securitytracker.com/id?1023429", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20170402100552/http://securitytracker.com/id?1023429" }, { "reference_url": "https://web.archive.org/web/20170908140655/http://www.securityfocus.com/archive/1/508830/100/0/threaded", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20170908140655/http://www.securityfocus.com/archive/1/508830/100/0/threaded" }, { "reference_url": "https://web.archive.org/web/20200228145937/http://www.securityfocus.com/bid/37710", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20200228145937/http://www.securityfocus.com/bid/37710" }, { "reference_url": "http://www.redhat.com/support/errata/RHSA-2011-0908.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.redhat.com/support/errata/RHSA-2011-0908.html" }, { "reference_url": "http://www.redhat.com/support/errata/RHSA-2011-0909.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.redhat.com/support/errata/RHSA-2011-0909.html" }, { "reference_url": "http://www.ruby-lang.org/en/news/2010/01/10/webrick-escape-sequence-injection", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.ruby-lang.org/en/news/2010/01/10/webrick-escape-sequence-injection" }, { "reference_url": "http://www.ush.it/team/ush/hack_httpd_escape/adv.txt", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.ush.it/team/ush/hack_httpd_escape/adv.txt" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=554485", "reference_id": "554485", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554485" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2009-4492", "reference_id": "CVE-2009-4492", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-4492" }, { "reference_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/33489.txt", "reference_id": "CVE-2009-4492;OSVDB-61774", "reference_type": "exploit", "scores": [], "url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/33489.txt" }, { "reference_url": "https://www.securityfocus.com/bid/37710/info", "reference_id": "CVE-2009-4492;OSVDB-61774", "reference_type": "exploit", "scores": [], "url": "https://www.securityfocus.com/bid/37710/info" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2009-4492.yml", "reference_id": "CVE-2009-4492.YML", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2009-4492.yml" }, { "reference_url": "https://github.com/advisories/GHSA-6mq2-37j5-w6r6", "reference_id": "GHSA-6mq2-37j5-w6r6", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-6mq2-37j5-w6r6" }, { "reference_url": "https://security.gentoo.org/glsa/201001-09", "reference_id": "GLSA-201001-09", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/201001-09" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2011:0908", "reference_id": "RHSA-2011:0908", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2011:0908" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2011:0909", "reference_id": "RHSA-2011:0909", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2011:0909" }, { "reference_url": "https://usn.ubuntu.com/900-1/", "reference_id": "USN-900-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/900-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/25135?format=api", "purl": "pkg:gem/webrick@1.4.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3wgz-s6g4-n3fk" }, { "vulnerability": "VCID-pay9-phaz-bbde" }, { "vulnerability": "VCID-vcz9-dvf4-47am" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/webrick@1.4.0" } ], "aliases": [ "CVE-2009-4492", "GHSA-6mq2-37j5-w6r6", "OSV-61774" ], "risk_score": 10.0, "exploitability": "2.0", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bv9s-j5yk-m3aw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/30051?format=api", "vulnerability_id": "VCID-pay9-phaz-bbde", "summary": "Ruby WEBrick read_headers method can lead to HTTP Request/Response Smuggling\nRuby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions.\n\nThe specific flaw exists within the read_headers method. The issue results from the inconsistent parsing of terminators of HTTP headers. An attacker can leverage this vulnerability to smuggle arbitrary HTTP requests. Was ZDI-CAN-21876.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-6442.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-6442.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-6442", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.22414", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.22417", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.22399", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.22551", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.22454", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.22495", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.22508", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.22476", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.22421", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.2234", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00257", "scoring_system": "epss", "scoring_elements": "0.49059", "published_at": "2026-04-21T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-6442" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/advisories/GHSA-r995-q44h-hr64", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-r995-q44h-hr64" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2025-6442.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2025-6442.yml" }, { "reference_url": "https://github.com/ruby/webrick", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/webrick" }, { "reference_url": "https://github.com/ruby/webrick/commit/ee60354bcb84ec33b9245e1d1aa6e1f7e8132101#diff-ad02984d873efb089aa51551bc6b7d307a53e0ba1ac439e91d69c2e58a478864", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N" }, { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-06-25T20:41:55Z/" } ], "url": "https://github.com/ruby/webrick/commit/ee60354bcb84ec33b9245e1d1aa6e1f7e8132101#diff-ad02984d873efb089aa51551bc6b7d307a53e0ba1ac439e91d69c2e58a478864" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6442", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6442" }, { "reference_url": "https://www.zerodayinitiative.com/advisories/ZDI-25-414", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-414" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2374895", "reference_id": "2374895", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2374895" }, { "reference_url": "https://usn.ubuntu.com/7709-1/", "reference_id": "USN-7709-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7709-1/" }, { "reference_url": "https://usn.ubuntu.com/7840-1/", "reference_id": "USN-7840-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7840-1/" }, { "reference_url": "https://www.zerodayinitiative.com/advisories/ZDI-25-414/", "reference_id": "ZDI-25-414", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-06-25T20:41:55Z/" } ], "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-414/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/48587?format=api", "purl": "pkg:gem/webrick@1.8.2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/webrick@1.8.2" } ], "aliases": [ "CVE-2025-6442", "GHSA-r995-q44h-hr64" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-pay9-phaz-bbde" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/41892?format=api", "vulnerability_id": "VCID-vcz9-dvf4-47am", "summary": "Multiple vulnerabilities have been discovered in Ruby, the worst of which could lead to execution of arbitrary code.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-25613.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-25613.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-25613", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50605", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50627", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50623", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50581", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50595", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50487", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50618", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50575", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50544", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50571", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50524", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50579", "published_at": "2026-04-08T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-25613" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25613", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25613" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2020-25613.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2020-25613.yml" }, { "reference_url": "https://github.com/ruby/webrick", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/webrick" }, { "reference_url": "https://github.com/ruby/webrick/commit/076ac636bf48b7a492887ce4de7041de23e6c00d", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/webrick/commit/076ac636bf48b7a492887ce4de7041de23e6c00d" }, { "reference_url": "https://github.com/ruby/webrick/commit/7618049fa57ddad2efff2a7bc7dad7d2d8a311b1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/webrick/commit/7618049fa57ddad2efff2a7bc7dad7d2d8a311b1" }, { "reference_url": "https://github.com/ruby/webrick/commit/8946bb38b4d87549f0d99ed73c62c41933f97cc7", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/webrick/commit/8946bb38b4d87549f0d99ed73c62c41933f97cc7" }, { "reference_url": "https://github.com/ruby/webrick/commit/af2efdcdf826f25592202d187c53963e7932e4b9", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/webrick/commit/af2efdcdf826f25592202d187c53963e7932e4b9" }, { "reference_url": "https://hackerone.com/reports/965267", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://hackerone.com/reports/965267" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFP3E7KXXT3H3KA6CBZPUOGA5VPFARRJ", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFP3E7KXXT3H3KA6CBZPUOGA5VPFARRJ" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTZURYROG3FFED3TYCQOBV66BS4K6WOV", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTZURYROG3FFED3TYCQOBV66BS4K6WOV" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PFP3E7KXXT3H3KA6CBZPUOGA5VPFARRJ", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PFP3E7KXXT3H3KA6CBZPUOGA5VPFARRJ" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTZURYROG3FFED3TYCQOBV66BS4K6WOV", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTZURYROG3FFED3TYCQOBV66BS4K6WOV" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25613", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25613" }, { "reference_url": "https://security.gentoo.org/glsa/202401-27", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/202401-27" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210115-0008", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20210115-0008" }, { "reference_url": "https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613" }, { "reference_url": "https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1883623", "reference_id": "1883623", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1883623" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=972230", "reference_id": "972230", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=972230" }, { "reference_url": "https://github.com/advisories/GHSA-gwfg-cqmg-cf8f", "reference_id": "GHSA-gwfg-cqmg-cf8f", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-gwfg-cqmg-cf8f" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2104", "reference_id": "RHSA-2021:2104", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2104" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2229", "reference_id": "RHSA-2021:2229", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2229" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2230", "reference_id": "RHSA-2021:2230", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2230" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2584", "reference_id": "RHSA-2021:2584", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2584" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2587", "reference_id": "RHSA-2021:2587", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2587" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2588", "reference_id": "RHSA-2021:2588", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2588" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0581", "reference_id": "RHSA-2022:0581", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0581" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0582", "reference_id": "RHSA-2022:0582", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0582" }, { "reference_url": "https://usn.ubuntu.com/4882-1/", "reference_id": "USN-4882-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4882-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/84723?format=api", "purl": "pkg:gem/webrick@1.4.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3wgz-s6g4-n3fk" }, { "vulnerability": "VCID-pay9-phaz-bbde" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/webrick@1.4.4" }, { "url": "http://public2.vulnerablecode.io/api/packages/84722?format=api", "purl": "pkg:gem/webrick@1.5.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3wgz-s6g4-n3fk" }, { "vulnerability": "VCID-pay9-phaz-bbde" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/webrick@1.5.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/84720?format=api", "purl": "pkg:gem/webrick@1.6.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3wgz-s6g4-n3fk" }, { "vulnerability": "VCID-pay9-phaz-bbde" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/webrick@1.6.1" } ], "aliases": [ "CVE-2020-25613", "GHSA-gwfg-cqmg-cf8f" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-vcz9-dvf4-47am" } ], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/14275?format=api", "vulnerability_id": "VCID-2yym-f64y-v7hf", "summary": "WEBrick Denial of Service Vulnerability\nhttputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of service (CPU consumption) via a crafted HTTP request. NOTE: this issue exists because of an incomplete fix for CVE-2008-3656.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2008-4310.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2008-4310.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2008-4310", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.05791", "scoring_system": "epss", "scoring_elements": "0.90518", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.05791", "scoring_system": "epss", "scoring_elements": "0.90461", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.05791", "scoring_system": "epss", "scoring_elements": "0.90465", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.05791", "scoring_system": "epss", "scoring_elements": "0.90477", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.05791", "scoring_system": "epss", "scoring_elements": "0.90482", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.05791", "scoring_system": "epss", "scoring_elements": "0.90495", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.05791", "scoring_system": "epss", "scoring_elements": "0.90501", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.05791", "scoring_system": "epss", "scoring_elements": "0.90508", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.05791", "scoring_system": "epss", "scoring_elements": "0.90502", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.05791", "scoring_system": "epss", "scoring_elements": "0.9052", "published_at": "2026-04-18T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2008-4310" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=470252", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=470252" }, { "reference_url": "http://secunia.com/advisories/33013", "reference_id": "", "reference_type": "", "scores": [], "url": "http://secunia.com/advisories/33013" }, { "reference_url": "https://github.com/ruby/webrick", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/webrick" }, { "reference_url": "https://github.com/ruby/webrick/commit/b2ccd5ff7ddd67a4548299e110dcc5a4728a5534", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/webrick/commit/b2ccd5ff7ddd67a4548299e110dcc5a4728a5534" }, { "reference_url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10250", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10250" }, { "reference_url": "https://web.archive.org/web/20111230125610/http://secunia.com/advisories/33013", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20111230125610/http://secunia.com/advisories/33013" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2008/12/04/2", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2008/12/04/2" }, { "reference_url": "http://www.redhat.com/support/errata/RHSA-2008-0981.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.redhat.com/support/errata/RHSA-2008-0981.html" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:1.8.1:*:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:ruby-lang:ruby:1.8.1:*:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:1.8.1:*:*:*:*:*:*:*" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:1.8.5:*:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:ruby-lang:ruby:1.8.5:*:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:1.8.5:*:*:*:*:*:*:*" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2008-4310", "reference_id": "CVE-2008-4310", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:L/Au:N/C:N/I:N/A:C" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-4310" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2008-4310.yml", "reference_id": "CVE-2008-4310.YML", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2008-4310.yml" }, { "reference_url": "https://github.com/advisories/GHSA-wfrc-r6c6-7j9r", "reference_id": "GHSA-wfrc-r6c6-7j9r", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-wfrc-r6c6-7j9r" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2008:0981", "reference_id": "RHSA-2008:0981", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2008:0981" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/50471?format=api", "purl": "pkg:gem/webrick@1.3.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3wgz-s6g4-n3fk" }, { "vulnerability": "VCID-91b7-xx8t-rqhr" }, { "vulnerability": "VCID-bv9s-j5yk-m3aw" }, { "vulnerability": "VCID-pay9-phaz-bbde" }, { "vulnerability": "VCID-vcz9-dvf4-47am" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/webrick@1.3.1" } ], "aliases": [ "CVE-2008-4310", "GHSA-wfrc-r6c6-7j9r" ], "risk_score": 10.0, "exploitability": "2.0", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-2yym-f64y-v7hf" } ], "risk_score": "10.0", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/webrick@1.3.1" }