VYPR
← All advisories
High severityNVD Advisory· Published Oct 6, 2020· Updated Aug 4, 2024

CVE-2020-25613

CVE-2020-25613

Description

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2020-25613 is an HTTP request smuggling vulnerability in Ruby's WEBrick server due to improper validation of the Transfer-Encoding header.

Vulnerability

CVE-2020-25613 is an HTTP request smuggling vulnerability in WEBrick, the HTTP server toolkit bundled with Ruby. The issue arises because WEBrick did not rigorously validate the Transfer-Encoding header value [1][2]. This lax header checking allows an attacker to craft HTTP requests that are interpreted differently by WEBrick and an intermediary reverse proxy.

Exploitation

Exploitation requires a reverse proxy situated in front of the WEBrick server that also performs weak validation of the Transfer-Encoding header [1]. An attacker sends a specially crafted HTTP request where the Transfer-Encoding header is ambiguous or malformed. The proxy and WEBrick parse the request differently, enabling the attacker to 'smuggle' a second, malicious request past the proxy to be processed by WEBrick [1]. No authentication is needed to exploit this; the attack is performed over the network.

Impact

Successful exploitation results in HTTP Request Smuggling. The attacker can bypass reverse proxy controls, potentially allowing them to poison web caches, perform session hijacking, or execute cross-site scripting (XSS) attacks on users [1]. The integrity of the proxy's security boundary is compromised, and other users may be served attacker-controlled responses.

Mitigation

The vulnerability was patched by the Ruby project. Users should update WEBrick to a version containing the fix, which is included in Ruby 2.5.9, 2.6.7, 2.7.2, and later versions [1]. The fix involves stricter checking of the Transfer-Encoding header [1]. There is no mention of this CVE being listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

References
  1. NVD - CVE-2020-25613
  2. GitHub - ruby/webrick: HTTP server toolkit

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
webrickRubyGems
>= 1.6.0, < 1.6.11.6.1
webrickRubyGems
>= 1.5.0, < 1.5.11.5.1
webrickRubyGems
< 1.4.41.4.4

Affected products

43

Patches

4
8946bb38b4d8

Make it more strict to interpret some headers

https://github.com/ruby/webrickYusuke EndohSep 29, 2020via ghsa
commit
1 file changed · +3 −3
  • lib/webrick/httprequest.rb+3 −3 modified
    @@ -227,9 +227,9 @@ def parse(socket=nil)
         raise HTTPStatus::BadRequest, "bad URI `#{@unparsed_uri}'."
       end
 
-      if /close/io =~ self["connection"]
+      if /\Aclose\z/io =~ self["connection"]
         @keep_alive = false
-      elsif /keep-alive/io =~ self["connection"]
+      elsif /\Akeep-alive\z/io =~ self["connection"]
         @keep_alive = true
       elsif @http_version < "1.1"
         @keep_alive = false
@@ -508,7 +508,7 @@ def read_body(socket, block)
       return unless socket
       if tc = self['transfer-encoding']
         case tc
-        when /chunked/io then read_chunked(socket, block)
+        when /\Achunked\z/io then read_chunked(socket, block)
         else raise HTTPStatus::NotImplemented, "Transfer-Encoding: #{tc}."
         end
       elsif self['content-length'] || @remaining_size
076ac636bf48

Make it more strict to interpret some headers

https://github.com/ruby/webrickYusuke EndohSep 29, 2020via ghsa
commit
1 file changed · +3 −3
  • lib/webrick/httprequest.rb+3 −3 modified
    @@ -226,9 +226,9 @@ def parse(socket=nil)
         raise HTTPStatus::BadRequest, "bad URI `#{@unparsed_uri}'."
       end
 
-      if /close/io =~ self["connection"]
+      if /\Aclose\z/io =~ self["connection"]
         @keep_alive = false
-      elsif /keep-alive/io =~ self["connection"]
+      elsif /\Akeep-alive\z/io =~ self["connection"]
         @keep_alive = true
       elsif @http_version < "1.1"
         @keep_alive = false
@@ -503,7 +503,7 @@ def read_body(socket, block)
       return unless socket
       if tc = self['transfer-encoding']
         case tc
-        when /chunked/io then read_chunked(socket, block)
+        when /\Achunked\z/io then read_chunked(socket, block)
         else raise HTTPStatus::NotImplemented, "Transfer-Encoding: #{tc}."
         end
       elsif self['content-length'] || @remaining_size
7618049fa57d

Make it more strict to interpret some headers

https://github.com/ruby/webrickYusuke EndohSep 29, 2020via ghsa
commit
1 file changed · +3 −3
  • lib/webrick/httprequest.rb+3 −3 modified
    @@ -226,9 +226,9 @@ def parse(socket=nil)
         raise HTTPStatus::BadRequest, "bad URI `#{@unparsed_uri}'."
       end
 
-      if /close/io =~ self["connection"]
+      if /\Aclose\z/io =~ self["connection"]
         @keep_alive = false
-      elsif /keep-alive/io =~ self["connection"]
+      elsif /\Akeep-alive\z/io =~ self["connection"]
         @keep_alive = true
       elsif @http_version < "1.1"
         @keep_alive = false
@@ -503,7 +503,7 @@ def read_body(socket, block)
       return unless socket
       if tc = self['transfer-encoding']
         case tc
-        when /chunked/io then read_chunked(socket, block)
+        when /\Achunked\z/io then read_chunked(socket, block)
         else raise HTTPStatus::NotImplemented, "Transfer-Encoding: #{tc}."
         end
       elsif self['content-length'] || @remaining_size
af2efdcdf826

Make it more strict to interpret some headers

https://github.com/ruby/webrickYusuke EndohSep 29, 2020via ghsa
commit
1 file changed · +3 −3
  • lib/webrick/httprequest.rb+3 −3 modified
    @@ -226,9 +226,9 @@ def parse(socket=nil)
         raise HTTPStatus::BadRequest, "bad URI `#{@unparsed_uri}'."
       end
 
-      if /close/io =~ self["connection"]
+      if /\Aclose\z/io =~ self["connection"]
         @keep_alive = false
-      elsif /keep-alive/io =~ self["connection"]
+      elsif /\Akeep-alive\z/io =~ self["connection"]
         @keep_alive = true
       elsif @http_version < "1.1"
         @keep_alive = false
@@ -503,7 +503,7 @@ def read_body(socket, block)
       return unless socket
       if tc = self['transfer-encoding']
         case tc
-        when /chunked/io then read_chunked(socket, block)
+        when /\Achunked\z/io then read_chunked(socket, block)
         else raise HTTPStatus::NotImplemented, "Transfer-Encoding: #{tc}."
         end
       elsif self['content-length'] || @remaining_size

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

20

News mentions

0

No linked articles in our index yet.