CVE-2024-22049: Debian Linux

Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days.

httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 38 only; version 39 only
• Jnunemaker Httparty: before 0.21.0 (fixed in 0.21.0)

Published 2024-01-04. Last modified 2026-07-14.