CVE-2020-25613: Fedoraproject Fedora

High severity, CVSS 7.5. EPSS: 3.8% chance of exploitation in the next 30 days.

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

Affected products

• Fedoraproject Fedora: version 32 only; version 33 only
• Ruby-Lang Ruby: up to and including 2.5.8; from 2.6.0, up to and including 2.6.6; from 2.7.0, up to and including 2.7.1
• Ruby-Lang Webrick: up to and including 1.6.0

Published 2020-10-06. Last modified 2026-06-17.