Executive brief
WEBrick, a web server library for the Ruby programming language, contains a flaw in how it handles specific types of web requests. An attacker can send a specially crafted request that tricks the server into misinterpreting the amount of data being sent. This can lead to 'request smuggling,' where an attacker can bypass security controls or interfere with other users' web traffic.
Technical details
WEBrick through version 1.9.2 incorrectly reparses 'Content-Length' values found in the trailers of chunked HTTP requests into the canonical request state. This causes the application to see a 'Content-Length' value provided by the attacker in the trailer, even if it contradicts the actual size of the chunked body already processed. By manipulating these headers, a remote attacker can achieve request smuggling or metadata confusion, potentially bypassing front-end security filters. The fix involves restricting allowed trailer headers and ensuring sensitive headers like 'Content-Length' and 'Transfer-Encoding' are disallowed in the trailer section.
Affected products
- Ruby WEBrick through 1.9.2
Timeline
- 2026-03-24: disclosed: Issue reported on GitHub
- 2026-03-25: patched: Pull request submitted to restrict allowed trailers
- 2026-07-02: advisory: CVE published to NVD