Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2020-25613

26
FAUCET Score

CVE-2020-25613 is a vulnerability in WEBrick, Ruby's bundled HTTP server, affecting Ruby versions up to 2.5.8, 2.6.6, and 2.7.1. It stems from insufficient validation of the transfer-encoding header, potentially enabling HTTP Request Smuggling attacks by bypassing reverse proxies. With a CVSS score of 7.5 (High), this vulnerability is network-exploitable with low attack complexity, allowing an unauthenticated attacker to achieve high integrity impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
<= 2.5.8CPE matchmatch criteria
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
>= 2.6.0, <= 2.6.6CPE matchmatch criteria
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
>= 2.7.0, <= 2.7.1CPE matchmatch criteria
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
<= 1.6.0CPE matchmatch criteria
cpe:2.3:a:ruby-lang:webrick:*:*:*:*:*:ruby:*:*
32CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
3.85%
Probability of exploitation in next 30 days
EPSS Percentile
89.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0385 is in the 81st percentile among its peer group of 51,485 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (22)

github_advisorypatch availablevia nvd_reference
View patch
microsoftpatch availablevia msrc
Product: cm1 ruby 2.6.6-2 on CBL Mariner 1.0Fixed in: 2.6.6-2
microsoftpatch availablevia msrc
Product: 19157-16820Fixed in: 2.6.6-2
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-ruby27-ruby-0:2.7.3-129.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-ruby26-ruby-0:2.6.7-119.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: ruby:2.7-8040020210421133318.522a0ee4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: ruby:2.5-8040020200923213910.522a0ee4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: ruby:2.6-8040020210430142949.522a0ee4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.1 Update Services for SAP SolutionsFixed in: ruby:2.6-8010020220201152941.c27ad7f8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Extended Update SupportFixed in: ruby:2.6-8020020220201131207.4cda2c84
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-ruby25-ruby-0:2.5.9-9.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-ruby27-ruby-0:2.7.3-129.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-ruby26-ruby-0:2.6.7-119.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-ruby25-ruby-0:2.5.9-9.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-ruby25-ruby-0:2.5.9-9.el7
View patch
rubygemspatch availablevia ghsa
Product: webrickFixed in: 1.5.1
rubygemspatch availablevia ghsa
Product: webrickFixed in: 1.6.1
rubygemspatch availablevia ghsa
Product: webrickFixed in: 1.4.4
redhatend of lifevia redhat_api
Product: Red Hat 3scale API Management Platform 2Fixed in: ruby-rack
redhatend of lifevia redhat_api
Product: Red Hat 3scale API Management Platform 2Fixed in: system
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: ruby
redhatend of lifevia redhat_api
Product: CloudForms Management Engine 5Fixed in: ruby

Vendor Advisories (3)

rubygemsGHSA-gwfg-cqmg-cf8fhigh

WEBRick vulnerable to HTTP Request/Response Smuggling

May 24, 2022
microsoft2020-Oct/CVE-2020-25613Important

An issue was discovered in Ruby through 2.5.8 2.6.x through 2.6.6 and 2.7.x through 2.7.1. WEBrick a simple HTTP server bundled with Ruby had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check) which may lead to an HTTP Request Smuggling attack.

Oct 13, 2020
redhatCVE-2020-25613Moderate

ruby: Potential HTTP request smuggling in WEBrick

Sep 29, 2020

References

github.com / ruby/webrick/commit/8946bb38b4d87549f0d99ed73c62c41933f97cc7
PatchThird Party Advisory
hackerone.com / reports/965267
Permissions RequiredThird Party Advisory
lists.debian.org / debian-lts-announce/2023/04/msg00033.html
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/PFP3E7KXXT3H3KA6CBZPUOGA5VPFARRJ
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/YTZURYROG3FFED3TYCQOBV66BS4K6WOV
security.gentoo.org / glsa/202401-27
security.netapp.com / advisory/ntap-20210115-0008
Third Party Advisory
ruby-lang.org / en/news/2020/09/29/http-request-smuggling-cve-2020-25613
Vendor Advisory