Is CVE-2026-38969 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-38969 being exploited in the wild.

How severe is CVE-2026-38969?

Informational severity, with a CVSS score of 0, published 2 July 2026.

Is there a fix for CVE-2026-38969?

A patch was published on 2026-03-25: Pull request submitted to restrict allowed trailers Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-38969 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-38969?

Check whether you run Ruby WEBrick at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-38969: Ruby WEBrick request smuggling via Content-Length in trailers

CVE-2026-38969 · Severity: info · CVSS 0 · Published 2026-07-02

WEBrick, a web server library for the Ruby programming language, contains a flaw in how it handles specific types of web requests. An attacker can send a specially crafted request that tricks the server into misinterpreting the amount of data being sent. This can lead to 'request smuggling,' where an attacker can bypass security controls or interfere with other users' web traffic.

Vendors: Ruby.

Quick answers

Is CVE-2026-38969 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-38969 being exploited in the wild.
How severe is CVE-2026-38969?: Informational severity, with a CVSS score of 0, published 2 July 2026.
Which products and versions are affected?: Ruby WEBrick through 1.9.2.
Is there a fix for CVE-2026-38969?: A patch was published on 2026-03-25: Pull request submitted to restrict allowed trailers Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-38969 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-38969?: Check whether you run Ruby WEBrick at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

WEBrick through version 1.9.2 incorrectly reparses 'Content-Length' values found in the trailers of chunked HTTP requests into the canonical request state. This causes the application to see a 'Content-Length' value provided by the attacker in the trailer, even if it contradicts the actual size of the chunked body already processed. By manipulating these headers, a remote attacker can achieve request smuggling or metadata confusion, potentially bypassing front-end security filters. The fix involves restricting allowed trailer headers and ensuring sensitive headers like 'Content-Length' and 'Transfer-Encoding' are disallowed in the trailer section.

Affected products

Ruby WEBrick through 1.9.2

Timeline

2026-03-24: disclosed: Issue reported on GitHub
2026-03-25: patched: Pull request submitted to restrict allowed trailers
2026-07-02: advisory: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.