{"id":"CVE-2024-47220","aliases":["DEBIAN-CVE-2024-47220","EUVD-2024-2733","GHSA-6f62-3596-g6w7","MGASA-2024-0348","OESA-2024-2226","OESA-2024-2247","ROOT-APP-RUBY-CVE-2024-47220","SUSE-SU-2024:3939-1","SUSE-SU-2025:0736-1","SUSE-SU-2025:1369-1","SUSE-SU-2025:4264-1","UBUNTU-CVE-2024-47220","USN-7057-1","USN-7057-2","USN-7840-1"],"status":"rejected","title":"HTTP Request Smuggling in ruby webrick","description":"DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2024-09-22T00:00:00Z","modified":"2026-10-28T20:15:18Z","fixes":[{"ecosystem":"RubyGems","package":"webrick","fixed_in":["1.8.2"],"sources":["ghsa","osv"]},{"ecosystem":"Mageia:9","package":"ruby-webrick","fixed_in":["1.7.0-3.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"rubygem-webrick","fixed_in":["1.7.0-2.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"rubygem-webrick","fixed_in":["1.7.0-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"rubygem-webrick","fixed_in":["1.7.0-2.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"rubygem-webrick","fixed_in":["1.7.0-2.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"rubygem-webrick","fixed_in":["1.7.0-2.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"ruby","fixed_in":["2.5.8-130.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Root:Ruby","package":"webrick","fixed_in":["1.6.1.41610.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"ruby2.1","fixed_in":["2.1.9-19.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"ruby2.1","fixed_in":["2.1.9-19.9.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby2.3","fixed_in":["2.3.1-2~ubuntu16.04.16+esm11"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby2.5","fixed_in":["2.5.1-1ubuntu1.16+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby2.7","fixed_in":["2.7.0-5ubuntu1.18+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"ruby-webrick","fixed_in":["1.7.0-3ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"ruby-webrick","fixed_in":["1.8.1-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"ruby-webrick","fixed_in":["1.8.1-1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"webrick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.8.1"},{"fixed":"1.8.2"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"webrick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2"}]}],"versions":["1.3.1","1.4.0","1.4.0.beta1","1.4.1","1.4.2","1.4.3","1.4.4","1.5.0","1.5.1","1.6.0","1.6.1","1.7.0","1.8.0","1.8.1"]},{"source":"osv","ecosystem":"Mageia:9","package":"ruby-webrick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-3.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"rubygem-webrick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-2.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"rubygem-webrick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"rubygem-webrick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-2.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"rubygem-webrick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-2.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"rubygem-webrick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-2.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.8-130.oe2003sp4"}]}]},{"source":"osv","ecosystem":"Root:Ruby","package":"webrick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1.41610.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"ruby2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.9-19.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"ruby2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.9-19.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.41.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.41.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.41.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.41.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.41.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.41.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.41.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.41.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.41.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.41.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.41.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.41.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.41.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.41.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.41.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.41.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150700.24.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby2.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-2~ubuntu16.04.16+esm11"}]}],"versions":["2.3.0-1","2.3.0-2","2.3.0-4ubuntu2","2.3.0-4ubuntu3","2.3.0-5ubuntu1","2.3.1-2~16.04","2.3.1-2~16.04.2","2.3.1-2~16.04.4","2.3.1-2~16.04.5","2.3.1-2~16.04.6","2.3.1-2~16.04.7","2.3.1-2~16.04.9","2.3.1-2~16.04.10","2.3.1-2~16.04.11","2.3.1-2~16.04.12","2.3.1-2~ubuntu16.04.13","2.3.1-2~ubuntu16.04.14","2.3.1-2~ubuntu16.04.15","2.3.1-2~ubuntu16.04.16","2.3.1-2~ubuntu16.04.16+esm1","2.3.1-2~ubuntu16.04.16+esm2","2.3.1-2~ubuntu16.04.16+esm3","2.3.1-2~ubuntu16.04.16+esm4","2.3.1-2~ubuntu16.04.16+esm5","2.3.1-2~ubuntu16.04.16+esm6","2.3.1-2~ubuntu16.04.16+esm7","2.3.1-2~ubuntu16.04.16+esm8","2.3.1-2~ubuntu16.04.16+esm9","2.3.1-2~ubuntu16.04.16+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1ubuntu1.16+esm6"}]}],"versions":["2.5.0~preview1-1ubuntu2","2.5.0-4ubuntu1","2.5.0-4ubuntu4","2.5.0-5ubuntu1","2.5.0-6ubuntu1","2.5.1-1ubuntu1","2.5.1-1ubuntu1.1","2.5.1-1ubuntu1.2","2.5.1-1ubuntu1.4","2.5.1-1ubuntu1.5","2.5.1-1ubuntu1.6","2.5.1-1ubuntu1.7","2.5.1-1ubuntu1.8","2.5.1-1ubuntu1.9","2.5.1-1ubuntu1.10","2.5.1-1ubuntu1.11","2.5.1-1ubuntu1.12","2.5.1-1ubuntu1.13","2.5.1-1ubuntu1.14","2.5.1-1ubuntu1.15","2.5.1-1ubuntu1.16","2.5.1-1ubuntu1.16+esm1","2.5.1-1ubuntu1.16+esm3","2.5.1-1ubuntu1.16+esm4","2.5.1-1ubuntu1.16+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-5ubuntu1.18+esm3"}]}],"versions":["2.7.0-1","2.7.0-2","2.7.0-3","2.7.0-4","2.7.0-4ubuntu1","2.7.0-5ubuntu1","2.7.0-5ubuntu1.1","2.7.0-5ubuntu1.2","2.7.0-5ubuntu1.3","2.7.0-5ubuntu1.4","2.7.0-5ubuntu1.5","2.7.0-5ubuntu1.6","2.7.0-5ubuntu1.7","2.7.0-5ubuntu1.8","2.7.0-5ubuntu1.9","2.7.0-5ubuntu1.10","2.7.0-5ubuntu1.11","2.7.0-5ubuntu1.12","2.7.0-5ubuntu1.13","2.7.0-5ubuntu1.14","2.7.0-5ubuntu1.15","2.7.0-5ubuntu1.16","2.7.0-5ubuntu1.17","2.7.0-5ubuntu1.18","2.7.0-5ubuntu1.18+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby-webrick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-3ubuntu0.1"}]}],"versions":["1.7.0-1","1.7.0-2","1.7.0-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby-webrick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1ubuntu0.1"}]}],"versions":["1.8.1-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ruby-webrick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1ubuntu1"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby-webrick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1ubuntu0.1"}]}],"versions":["1.8.1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby-webrick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-3ubuntu0.1"}]}],"versions":["1.7.0-1","1.7.0-2","1.7.0-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby2.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-2~ubuntu16.04.16+esm11"}]}],"versions":["2.3.0-1","2.3.0-2","2.3.0-4ubuntu2","2.3.0-4ubuntu3","2.3.0-5ubuntu1","2.3.1-2~16.04","2.3.1-2~16.04.2","2.3.1-2~16.04.4","2.3.1-2~16.04.5","2.3.1-2~16.04.6","2.3.1-2~16.04.7","2.3.1-2~16.04.9","2.3.1-2~16.04.10","2.3.1-2~16.04.11","2.3.1-2~16.04.12","2.3.1-2~ubuntu16.04.13","2.3.1-2~ubuntu16.04.14","2.3.1-2~ubuntu16.04.15","2.3.1-2~ubuntu16.04.16","2.3.1-2~ubuntu16.04.16+esm1","2.3.1-2~ubuntu16.04.16+esm2","2.3.1-2~ubuntu16.04.16+esm3","2.3.1-2~ubuntu16.04.16+esm4","2.3.1-2~ubuntu16.04.16+esm5","2.3.1-2~ubuntu16.04.16+esm6","2.3.1-2~ubuntu16.04.16+esm7","2.3.1-2~ubuntu16.04.16+esm8","2.3.1-2~ubuntu16.04.16+esm9","2.3.1-2~ubuntu16.04.16+esm10"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1ubuntu1.16+esm6"}]}],"versions":["2.5.0~preview1-1ubuntu2","2.5.0-4ubuntu1","2.5.0-4ubuntu4","2.5.0-5ubuntu1","2.5.0-6ubuntu1","2.5.1-1ubuntu1","2.5.1-1ubuntu1.1","2.5.1-1ubuntu1.2","2.5.1-1ubuntu1.4","2.5.1-1ubuntu1.5","2.5.1-1ubuntu1.6","2.5.1-1ubuntu1.7","2.5.1-1ubuntu1.8","2.5.1-1ubuntu1.9","2.5.1-1ubuntu1.10","2.5.1-1ubuntu1.11","2.5.1-1ubuntu1.12","2.5.1-1ubuntu1.13","2.5.1-1ubuntu1.14","2.5.1-1ubuntu1.15","2.5.1-1ubuntu1.16","2.5.1-1ubuntu1.16+esm1","2.5.1-1ubuntu1.16+esm3","2.5.1-1ubuntu1.16+esm4","2.5.1-1ubuntu1.16+esm5"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-5ubuntu1.18+esm3"}]}],"versions":["2.7.0-1","2.7.0-2","2.7.0-3","2.7.0-4","2.7.0-4ubuntu1","2.7.0-5ubuntu1","2.7.0-5ubuntu1.1","2.7.0-5ubuntu1.2","2.7.0-5ubuntu1.3","2.7.0-5ubuntu1.4","2.7.0-5ubuntu1.5","2.7.0-5ubuntu1.6","2.7.0-5ubuntu1.7","2.7.0-5ubuntu1.8","2.7.0-5ubuntu1.9","2.7.0-5ubuntu1.10","2.7.0-5ubuntu1.11","2.7.0-5ubuntu1.12","2.7.0-5ubuntu1.13","2.7.0-5ubuntu1.14","2.7.0-5ubuntu1.15","2.7.0-5ubuntu1.16","2.7.0-5ubuntu1.17","2.7.0-5ubuntu1.18","2.7.0-5ubuntu1.18+esm1"],"bundled":6}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47220","tags":["advisory"]},{"url":"https://github.com/ruby/webrick/issues/145","tags":["report","web"]},{"url":"https://github.com/ruby/webrick/pull/146/commits/d88321da45dcd230ac2b4585cad4833d6d5e8841","tags":["web"]},{"url":"https://github.com/ruby/webrick/commit/f5faca9222541591e1a7c3c97552ebb0c92733c7","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2024-47220.yml","tags":["web"]},{"url":"https://github.com/ruby/webrick/issues/145#issuecomment-2369994610","tags":["report","web"]},{"url":"https://github.com/ruby/webrick/issues/145#issuecomment-2372838285","tags":["report","web"]},{"url":"https://github.com/advisories/GHSA-6f62-3596-g6w7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47220.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-47220","tags":["advisory"]},{"url":"https://github.com/ruby/webrick","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2024-0348.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33617","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7057-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2226","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2247","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243939-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230930","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47220","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250736-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1232440","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49761","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251369-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1235773","tags":["report"]},{"url":"https://bugzilla.suse.com/1237804","tags":["report"]},{"url":"https://bugzilla.suse.com/1237806","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27220","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254264-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1225905","tags":["report"]},{"url":"https://bugzilla.suse.com/1237805","tags":["report"]},{"url":"https://bugzilla.suse.com/1245254","tags":["report"]},{"url":"https://bugzilla.suse.com/1246430","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6442","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-47220","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47220","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7057-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7840-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-35176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-39908","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41946","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-6442","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-47220","description":"DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"rejected","published":"2024-09-22T00:00:00Z","modified":"2026-07-21T13:15:12.252Z","updated_at":"2026-11-02T14:33:57.302325Z"}],"euvd":[{"id":"EUVD-2024-2733","description":"DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"published","published":"2024-09-22T00:00:00Z","modified":"2026-07-21T13:15:12Z","updated_at":"2026-11-02T18:19:47.436242Z"}],"ghsa":[{"id":"GHSA-6f62-3596-g6w7","title":"HTTP Request Smuggling in ruby webrick","description":"An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., \"GET /admin HTTP/1.1\\r\\n\" inside of a \"POST /user HTTP/1.1\\r\\n\" request. NOTE: the supplier's position is \"Webrick should not be used in production.\"","status":"published","published":"2024-09-22T03:30:30Z","modified":"2024-09-25T17:53:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:38:06.29677Z"}],"nvd":[{"id":"CVE-2024-47220","description":"Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"rejected","published":"2024-09-22T01:15:11.95Z","modified":"2026-07-21T14:16:32.673Z","updated_at":"2026-11-02T14:10:27.456509Z"}],"osv":[{"id":"GHSA-6f62-3596-g6w7","title":"HTTP Request Smuggling in ruby webrick","description":"An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., \"GET /admin HTTP/1.1\\r\\n\" inside of a \"POST /user HTTP/1.1\\r\\n\" request. NOTE: the supplier's position is \"Webrick should not be used in production.\"","status":"published","published":"2024-09-22T03:30:30Z","modified":"2026-09-10T03:50:18.821555207Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"OESA-2024-2226","title":"rubygem-webrick security update","description":"WEBrick is an HTTP server toolkit that can be configured as an HTTPS server, a proxy server, and a virtual-host server.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., \u0026quot;GET /admin HTTP/1.1\\r\\n\u0026quot; inside of a \u0026quot;POST /user HTTP/1.1\\r\\n\u0026quot; request. NOTE: the supplier\u0026apos;s position is \u0026quot;Webrick should not be used in production.\u0026quot;(CVE-2024-47220)","status":"published","published":"2024-10-12T11:07:42Z","modified":"2026-08-18T01:17:34.2926062Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2247","title":"ruby security update","description":"Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl).\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., \u0026quot;GET /admin HTTP/1.1\\r\\n\u0026quot; inside of a \u0026quot;POST /user HTTP/1.1\\r\\n\u0026quot; request. NOTE: the supplier\u0026apos;s position is \u0026quot;Webrick should not be used in production.\u0026quot;(CVE-2024-47220)","status":"published","published":"2024-10-12T11:07:43Z","modified":"2026-08-18T01:17:34.643369701Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"CVE-2024-47220","description":"An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., \"GET /admin HTTP/1.1\\r\\n\" inside of a \"POST /user HTTP/1.1\\r\\n\" request. NOTE: the supplier's position is \"Webrick should not be used in production.\"","status":"published","published":"2024-09-22T00:00:00Z","modified":"2026-07-23T03:56:25.623911253Z","updated_at":"2026-11-02T15:44:43.253252Z"},{"id":"DEBIAN-CVE-2024-47220","description":"An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., \"GET /admin HTTP/1.1\\r\\n\" inside of a \"POST /user HTTP/1.1\\r\\n\" request. NOTE: the supplier's position is \"Webrick should not be used in production.\"","status":"withdrawn","published":"2024-09-22T01:15:11.95Z","modified":"2026-07-22T02:00:46.296314797Z","updated_at":"2026-11-02T15:45:43.798789Z"},{"id":"MGASA-2024-0348","title":"Updated ruby-webrick packages fix security vulnerability","description":"An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby.\nIt allows HTTP request smuggling by providing both a Content-Length\nheader and a Transfer-Encoding header, e.g., \"GET /admin HTTP/1.1\\r\\n\"\ninside of a \"POST /user HTTP/1.1\\r\\n\" request. (CVE-2024-47220)\n","status":"published","published":"2024-11-08T22:09:56Z","modified":"2026-04-16T04:43:54.212007111Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"ROOT-APP-RUBY-CVE-2024-47220","title":"CVE-2024-47220 in webrick - Patched by Root","description":"Root has patched CVE-2024-47220 in the webrick package for Root:Ruby. Multiple fixed versions available.","status":"published","published":"2026-10-27T11:14:09Z","modified":"2026-10-27T12:15:03.14201402Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"SUSE-SU-2024:3939-1","title":"Security update for ruby2.1","description":"This update for ruby2.1 fixes the following issues:\n\n- CVE-2024-47220: Fixed HTTP request smuggling in WEBrick (bsc#1230930) \n","status":"published","published":"2024-11-07T10:08:52Z","modified":"2026-02-04T02:34:23.801666Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2025:0736-1","title":"Security update for ruby2.5","description":"\nThis update for ruby2.5 fixes the following issues:\n\n- CVE-2024-47220: Fixed a HTTP request smuggling attack in WEBrick (bsc#1230930)\n- CVE-2024-49761: Fixed a ReDoS vulnerability in ruby rexml (bsc#1232440)\n\nOther fixes:\n\n- [ruby/uri] Fix quadratic backtracking on invalid relative URI\n- [ruby/time] Make RFC2822 regexp linear\n- [ruby/time] Fix quadratic backtracking on invalid time\n- merge some parts of CGI 0.1.1\n\n","status":"published","published":"2025-02-26T18:38:15Z","modified":"2026-02-04T03:29:40.258876Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:1369-1","title":"Security update for ruby2.5","description":"This update for ruby2.5 fixes the following issues:\n\n- CVE-2025-27219: Fixed denial of service in CGI::Cookie.parse (bsc#1237804)    \n- CVE-2025-27220: Fixed ReDoS in CGI::Util#escapeElement (bsc#1237806)\n \nOther fixes:\n- Improved fix for CVE-2024-47220 (bsc#1230930, bsc#1235773) \n","status":"published","published":"2025-04-24T17:11:21Z","modified":"2026-02-04T02:57:47.383126Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:4264-1","title":"Security update for ruby2.5","description":"This update for ruby2.5 fixes the following issues:\n\n- CVE-2024-35221: Fixed remote DoS via YAML manifest (bsc#1225905)\n- CVE-2024-47220: Fixed HTTP request smuggling in WEBrick (bsc#1230930)\n- CVE-2024-49761: Fixed ReDOS vulnerability by updating REXML to 3.3.9 (bsc#1232440)\n- CVE-2025-24294: Fixed denial of service (DoS) caused by an insufficient check on the length \n  of a decompressed domain name within a DNS packet in resolv gem (bsc#1246430)\n- CVE-2025-27219: Fixed denial of service in CGI::Cookie.parse (bsc#1237804)\n- CVE-2025-27220: Fixed ReDoS in CGI::Util#escapeElement (bsc#1237806)\n- CVE-2025-27221: Fixed userinfo leakage in URI#join, URI#merge and URI#+ (bsc#1237805)\n- CVE-2025-6442: Fixed ruby WEBrick read_header HTTP request smuggling vulnerability (bsc#1245254)\n","status":"published","published":"2025-11-26T15:52:44Z","modified":"2026-03-23T04:51:29.7996Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"UBUNTU-CVE-2024-47220","description":"Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"published","published":"2024-09-22T01:15:00Z","modified":"2026-10-28T20:15:18.130017246Z","updated_at":"2026-11-02T16:55:02.636559Z"},{"id":"USN-7057-1","title":"ruby-webrick vulnerability","description":"It was discovered that WEBrick incorrectly handled having both a Content-\nLength header and a Transfer-Encoding header. A remote attacker could\npossibly use this issue to perform a HTTP request smuggling attack.\n","status":"published","published":"2024-10-07T11:29:03Z","modified":"2026-04-27T17:30:27.332283Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7057-2","title":"ruby-webrick vulnerability","description":"USN-7057-1 fixed a vulnerability in WEBrick. This update provides the\ncorresponding updates for Ubuntu 22.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that WEBrick incorrectly handled having both a Content-\n Length header and a Transfer-Encoding header. A remote attacker could\n possibly use this issue to perform a HTTP request smuggling attack.\n","status":"published","published":"2024-10-08T16:35:10Z","modified":"2026-04-27T17:26:00.816342Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7840-1","title":"ruby2.3, ruby2.5, ruby2.7 vulnerabilities","description":"It was discovered that the REXML module bunded into Ruby incorrectly\nhandled parsing XML documents with repeated instances of certain\ncharacters. An attacker could possibly use this issue to cause REXML to\nconsume excessive resources, leading to a denial of service. Ubuntu 18.04\nLTS and Ubuntu 20.04 LTS were previously addressed in USN-7256-1 and\nUSN-7734-1. This update addresses the issue in Ubuntu 16.04 LTS.\n(CVE-2024-35176)\n\nIt was discovered that the REXML module bunded into Ruby incorrectly\nhandled parsing XML documents with repeated instances of certain\ncharacters. An attacker could possibly use this issue to cause REXML to\nconsume excessive resources, leading to a denial of service. Ubuntu 20.04\nLTS was previously addressed in USN-7256-1. This update addresses the issue\nin Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-39908, CVE-2024-41123)\n\nIt was discovered that the REXML module bunded into Ruby incorrectly\nhandled parsing XML documents with many entity expansions. An attacker\ncould possibly use this issue to cause REXML to consume excessive\nresources, leading to a denial of service. Ubuntu 20.04 LTS was previously\naddressed in USN-7091-2. This update addresses the issue in Ubuntu 16.04\nLTS and Ubuntu 18.04 LTS. (CVE-2024-41946)\n\nIt was discovered that the WEBrick module bundled into Ruby incorrectly\nhandled having both a Content-Length header and a Transfer-Encoding header.\nA remote attacker could possibly use this issue to perform a HTTP request\nsmuggling attack. (CVE-2024-47220)\n\nIt was discovered that the WEBrick module bundled into Ruby incorrectly\nparsed HTTP headers. In configurations where the WEBrick module is placed\nbehind an HTTP proxy, a remote attacker could possibly use this issue to\nperform an HTTP Request Smuggling attack. (CVE-2025-6442)","status":"published","published":"2025-10-27T14:39:58Z","modified":"2026-06-25T13:32:31.255143493Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}