Updated advisory posts against rubysec/ruby-advisory-db@561272a

jasnow · RubySec CI · commit 43bce591ad9d · 2025-06-28T13:15:49.000Z
diff --git a/advisories/_posts/2025-06-26-CVE-2025-6442.md b/advisories/_posts/2025-06-26-CVE-2025-6442.md
@@ -0,0 +1,36 @@
+---
+layout: advisory
+title: 'CVE-2025-6442 (webrick): Ruby WEBrick read_headers method can lead to HTTP
+  Request/Response Smuggling'
+comments: false
+categories:
+- webrick
+advisory:
+  gem: webrick
+  cve: 2025-6442
+  ghsa: r995-q44h-hr64
+  url: https://github.com/advisories/GHSA-r995-q44h-hr64
+  title: Ruby WEBrick read_headers method can lead to HTTP Request/Response Smuggling
+  date: 2025-06-26
+  description: |
+    Ruby WEBrick read_header HTTP Request Smuggling Vulnerability
+
+    This vulnerability allows remote attackers to smuggle arbitrary HTTP
+    requests on affected installations of Ruby WEBrick. This issue is
+    exploitable when the product is deployed behind an HTTP proxy that
+    fulfills specific conditions.
+
+    The specific flaw exists within the read_headers method. The issue
+    results from the inconsistent parsing of terminators of HTTP headers.
+    An attacker can leverage this vulnerability to smuggle arbitrary
+    HTTP requests. Was ZDI-CAN-21876.
+  cvss_v3: 6.5
+  patched_versions:
+  - ">= 1.8.2"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-6442
+    - https://github.com/ruby/webrick/commit/ee60354bcb84ec33b9245e1d1aa6e1f7e8132101#diff-ad02984d873efb089aa51551bc6b7d307a53e0ba1ac439e91d69c2e58a478864
+    - https://www.zerodayinitiative.com/advisories/ZDI-25-414
+    - https://github.com/advisories/GHSA-r995-q44h-hr64
+---
