CVE-2026-38969
WEBrick Request Smuggling
Description
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
INFO
Published Date :
July 2, 2026, 9:16 p.m.
Last Modified :
July 14, 2026, 5:16 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-38969
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
Solution
- Update WEBrick to version 1.9.3 or later.
- Apply security patches for WEBrick.
- Ensure proper request handling configurations.
Public PoC/Exploit Available at Github
CVE-2026-38969 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
Ruby Makefile CSS HTML
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-38969 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-38969 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Rejected by [email protected]
Jul. 14, 2026
Action Type Old Value New Value -
CVE Modified by [email protected]
Jul. 14, 2026
Action Type Old Value New Value Removed Affected [{'vendor': 'n/a', 'product': 'n/a', 'versions': [{'status': 'affected', 'version': 'n/a'}]}] Removed SSVC {'id': 'CVE-2026-38969', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-07-06T14:45:28.645063Z'} Removed Tag MITRE: disputed Changed Description ruby webrick through v1.9.2 WEBrick reparses trailer Content-Length into canonical request state, enabling request smuggling. NOTE: the Supplier reports that "The project README states that it is suitable for testing and development, and that its developers do not encourage its use to serve production web applications that may be subject to hostile input. It is not a production web server and is not intended to receive traffic from untrusted sources. Request smuggling is only reachable when WEBrick sits behind a proxy and receives hostile traffic in a production deployment, which is the configuration the project documents as discouraged." Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Removed CVSS V3.1 CISA-ADP: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Removed CWE CISA-ADP: CWE-444 Removed Reference MITRE: https://github.com/ruby/webrick/blob/master/README.md Removed Reference MITRE: https://github.com/ruby/webrick/issues/198 Removed Reference MITRE: https://github.com/ruby/webrick/pull/199 Removed Reference CISA-ADP: https://github.com/ruby/webrick/issues/198 -
CVE Modified by [email protected]
Jul. 10, 2026
Action Type Old Value New Value Added Tag disputed Changed Description ruby webrick through v1.9.2 WEBrick reparses trailer Content-Length into canonical request state, enabling request smuggling. ruby webrick through v1.9.2 WEBrick reparses trailer Content-Length into canonical request state, enabling request smuggling. NOTE: the Supplier reports that "The project README states that it is suitable for testing and development, and that its developers do not encourage its use to serve production web applications that may be subject to hostile input. It is not a production web server and is not intended to receive traffic from untrusted sources. Request smuggling is only reachable when WEBrick sits behind a proxy and receives hostile traffic in a production deployment, which is the configuration the project documents as discouraged." Added Reference https://github.com/ruby/webrick/blob/master/README.md -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 06, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Added CWE CWE-444 Added Reference https://github.com/ruby/webrick/issues/198 Added SSVC {'id': 'CVE-2026-38969', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-07-06T14:45:28.645063Z'} -
New CVE Received by [email protected]
Jul. 02, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'n/a', 'product': 'n/a', 'versions': [{'status': 'affected', 'version': 'n/a'}]}] Added Description ruby webrick through v1.9.2 WEBrick reparses trailer Content-Length into canonical request state, enabling request smuggling. Added Reference https://github.com/ruby/webrick/issues/198 Added Reference https://github.com/ruby/webrick/pull/199