CVE-2026-38969

ruby webrick through v1.9.2 WEBrick reparses trailer Content-Length into canonical request state,...

7.5 HighRejected

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

What each source reports

GitHub Advisories Score usedGHSA-h4w6-wx8r-p68v 7.5

ruby webrick through v1.9.2 WEBrick reparses trailer Content-Length into canonical request state,...

ruby webrick through v1.9.2 WEBrick reparses trailer Content-Length into canonical request state, enabling request smuggling.

Record: GHSA-h4w6-wx8r-p68v
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-444
Updated: 2026-11-02

CVE List No score

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Record: CVE-2026-38969
Updated: 2026-11-02

EUVDEUVD-2026-41473 7.5

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Record: EUVD-2026-41473
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

NVD No score

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Record: CVE-2026-38969
Updated: 2026-11-02

OSV 7.5

ruby webrick through v1.9.2 WEBrick reparses trailer Content-Length into canonical request state, enabling request smuggling. NOTE: the Supplier reports that "The project README states that it is suitable for testing and development, and that its developers do not encourage its use to serve production web applications that may be subject to hostile input. It is not a production web server and is not intended to receive traffic from untrusted sources. Request smuggling is only reachable when WEBrick sits behind a proxy and receives hostile traffic in a production deployment, which is the configuration the project documents as discouraged."

Record: CVE-2026-38969
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2026:34975 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:34975
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-38969 7.5

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Record: UBUNTU-CVE-2026-38969
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`cargo` Red Hat:hummingbird:1 From an advisory covering 24 CVEs	before 0:1.96.1-1.hum1	0:1.96.1-1.hum1
`clippy` Red Hat:hummingbird:1 From an advisory covering 24 CVEs	before 0:1.96.1-1.hum1	0:1.96.1-1.hum1
`rust` Red Hat:hummingbird:1 From an advisory covering 24 CVEs	before 0:1.96.1-1.hum1	0:1.96.1-1.hum1
`rust-analyzer` Red Hat:hummingbird:1 From an advisory covering 24 CVEs	before 0:1.96.1-1.hum1	0:1.96.1-1.hum1
`rust-debugger-common` Red Hat:hummingbird:1 From an advisory covering 24 CVEs	before 0:1.96.1-1.hum1	0:1.96.1-1.hum1
`rust-doc` Red Hat:hummingbird:1 From an advisory covering 24 CVEs	before 0:1.96.1-1.hum1	0:1.96.1-1.hum1
`rust-gdb` Red Hat:hummingbird:1 From an advisory covering 24 CVEs	before 0:1.96.1-1.hum1	0:1.96.1-1.hum1
`rust-lldb` Red Hat:hummingbird:1 From an advisory covering 24 CVEs	before 0:1.96.1-1.hum1	0:1.96.1-1.hum1
`rust-src` Red Hat:hummingbird:1 From an advisory covering 24 CVEs	before 0:1.96.1-1.hum1	0:1.96.1-1.hum1
`rust-std-static` Red Hat:hummingbird:1 From an advisory covering 24 CVEs	before 0:1.96.1-1.hum1	0:1.96.1-1.hum1

Show 10 moreShow less

Affected packages
Package	Affected	Fixed
`rust-std-static-aarch64-unknown-none-softfloat` Red Hat:hummingbird:1 From an advisory covering 24 CVEs	before 0:1.96.1-1.hum1	0:1.96.1-1.hum1
`rust-std-static-aarch64-unknown-uefi` Red Hat:hummingbird:1 From an advisory covering 24 CVEs	before 0:1.96.1-1.hum1	0:1.96.1-1.hum1
`rust-std-static-i686-pc-windows-gnu` Red Hat:hummingbird:1 From an advisory covering 24 CVEs	before 0:1.96.1-1.hum1	0:1.96.1-1.hum1
`rust-std-static-wasm32-unknown-unknown` Red Hat:hummingbird:1 From an advisory covering 24 CVEs	before 0:1.96.1-1.hum1	0:1.96.1-1.hum1
`rust-std-static-wasm32-wasip1` Red Hat:hummingbird:1 From an advisory covering 24 CVEs	before 0:1.96.1-1.hum1	0:1.96.1-1.hum1
`rust-std-static-x86_64-pc-windows-gnu` Red Hat:hummingbird:1 From an advisory covering 24 CVEs	before 0:1.96.1-1.hum1	0:1.96.1-1.hum1
`rust-std-static-x86_64-unknown-none` Red Hat:hummingbird:1 From an advisory covering 24 CVEs	before 0:1.96.1-1.hum1	0:1.96.1-1.hum1
`rust-std-static-x86_64-unknown-uefi` Red Hat:hummingbird:1 From an advisory covering 24 CVEs	before 0:1.96.1-1.hum1	0:1.96.1-1.hum1
`rustfmt` Red Hat:hummingbird:1 From an advisory covering 24 CVEs	before 0:1.96.1-1.hum1	0:1.96.1-1.hum1
`ruby-webrick` Ubuntu:25.10	All versions, plus listed versions 1.8.1-1ubuntu11.9.1-1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	affected
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-38969 has been rejected by its source and should not be treated as a live vulnerability, published July 2, 2026.

References

Show 182 moreShow less