Ruby WEBrick CVE-2026-38969

Exploitation requires that WEBrick (<=1.9.2) process an HTTP request using chunked transfer encoding whose trailer section carries a Content-Length field, which WEBrick then reparses into canonical request state. The practical prerequisite is a request-smuggling topology: WEBrick deployed behind (or in front of) another HTTP component - reverse proxy, load balancer, CDN, or cache - that computes message length from the initial headers and therefore disagrees with WEBrick's trailer-derived length. Limiting factors: a single WEBrick instance with no differing intermediary and no connection reuse across trust boundaries is not meaningfully exploitable for smuggling; no authentication is required (PR:N) and no user interaction is needed, but success depends on the specific front-end/back-end parsing mismatch rather than any WEBrick default setting alone.

The CVSS 3.1 base is 7.5 (AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:N) - remotely reachable, low complexity, no authentication, with impact confined to integrity, which is consistent with a smuggling primitive that corrupts request state rather than reading memory or crashing the service. SSVC signals partial technical impact, Automatable:yes, and exploitation:poc, indicating a working proof of concept and scriptable exploitation. However EPSS is only 0.16% (6th percentile) and there is no CISA KEV listing, so widespread opportunistic exploitation is not currently evidenced - this reads as a real but not yet mass-exploited issue whose practical severity is highly deployment-dependent: exploitation requires a specific proxy/back-end topology where an upstream intermediary parses the request differently than WEBrick. As a standalone origin server with no desyncing front-end, real-world impact is materially lower than the 7.5 suggests.

An attacker sends a single crafted HTTP request through a front-end proxy to a WEBrick back end, using chunked transfer encoding with a trailer-embedded Content-Length that WEBrick honors but the proxy ignores. The length disagreement causes a prefix of the attacker's payload to be treated as the start of the next victim's request on the reused connection, letting the attacker prepend a smuggled request that poisons routing or captures another user's response. A proof-of-concept is referenced by the SSVC poc status, and the low attack complexity means the request can be delivered without special timing.