Ruby’s WEBrick server through version 1.9.2 re‑parses a trailing Content‑Length header when building the request state. This duplicate parsing allows an attacker to supply multiple or malformed Content‑Length values, resulting in an incorrect total size calculation. The consequence is HTTP request smuggling, which can cause the server to handle requests incorrectly or split traffic in ways that bypass downstream components. The CWE for this flaw is CWE‑444, indicating improper handling of duplicate headers.

Any installation of WEBrick 1.9.2 or earlier that accepts external HTTP or HTTPS traffic is vulnerable. The flaw is only exploitable when the server sits behind a proxy or load balancer in a production configuration. Lightweight, or applications that use WEBrick directly or through such a proxy are liable.

The CVSS score of 7.5 rates the flaw as high impact. The EPSS score is under 1 %, meaning that real‑world The vulnerability is not listed in the CISA KEV catalog. An attacker would need to send traffic that reaches WEBrick behind an upstream proxy and includes duplicate or malformed Content‑Length headers. No additional conditions such as privileged access arebased request smuggling in environments that rely on WEBrick in production.