CVE-2026-38969

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-38969
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-38969.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-38969
Downstream
Published
2026-07-02T00:00:00Z
Modified
2026-07-12T03:55:35.035569658Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

ruby webrick through v1.9.2 WEBrick reparses trailer Content-Length into canonical request state, enabling request smuggling. NOTE: the Supplier reports that "The project README states that it is suitable for testing and development, and that its developers do not encourage its use to serve production web applications that may be subject to hostile input. It is not a production web server and is not intended to receive traffic from untrusted sources. Request smuggling is only reachable when WEBrick sits behind a proxy and receives hostile traffic in a production deployment, which is the configuration the project documents as discouraged."

Database specific 
{
    "isDisputed": true,
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/38xxx/CVE-2026-38969.json"
}
References

Affected packages

Git / github.com/ruby/webrick

Affected ranges

Type
GIT
Repo
https://github.com/ruby/webrick
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b1684cecf9eb87cb2ae20fd52fbb80cf3e859c8a
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "v1.9.2"
        }
    ],
    "source": "DESCRIPTION"
}

Affected versions

v1.*
v1.4.0
v1.4.0.beta1
v1.4.1
v1.4.2
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.8.1
v1.8.2
v1.9.0
v1.9.1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-38969.json"