CVE-2025-68696
published 2025-12-23CVE-2025-68696: httparty is an API tool. In versions 0.23.2 and prior, httparty is vulnerable to SSRF. This issue can pose a risk of leaking API keys, and it can also allow…
PriorityP347high8.2CVSS 3.1
AVNACLPRNUINSUCHILAN
EPSS
0.26%
17.5th percentile
httparty is an API tool. In versions 0.23.2 and prior, httparty is vulnerable to SSRF. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. This issue has been patched via commit 0529bcd.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ruby-httparty | < ruby-httparty 0.24.2-1 (forky) | ruby-httparty 0.24.2-1 (forky) |
| jnunemaker | httparty | < 0.24.0 | 0.24.0 |
| jnunemaker | httparty | <= 0.23.2 | — |
| jnunemaker | httparty | >= 0 < 0.24.0 | 0.24.0 |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
nvdv4.07.8HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2025-68696: httparty is an API tool
osv·2025-12-23·CVSS 8.8
CVE-2025-68696 [HIGH] CVE-2025-68696: httparty is an API tool
httparty is an API tool. In versions 0.23.2 and prior, httparty is vulnerable to SSRF. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. This issue has been patched via commit 0529bcd.
GHSA
httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage
ghsa·2025-12-23
CVE-2025-68696 [HIGH] CWE-918 httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage
httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage
## Summary
There may be an SSRF vulnerability in httparty. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers.
## Details
When httparty receives a path argument that is an absolute URL, it ignores the `base_uri` field. As a result, if a malicious user can control the path value, the application may unintentionally communicate with a host that the programmer did not anticipate.
Consider the following example of a web application:
```rb
require 'sinatra'
require 'httparty'
class RepositoryClient
include HTTParty
base_uri 'http://exmaple.test/api/v1/repositories/'
headers 'X-API-KEY' => '1234567890'
end
post '/issue' do
request_body = JSON.pars
OSV
httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage
osv·2025-12-23
CVE-2025-68696 [HIGH] httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage
httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage
## Summary
There may be an SSRF vulnerability in httparty. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers.
## Details
When httparty receives a path argument that is an absolute URL, it ignores the `base_uri` field. As a result, if a malicious user can control the path value, the application may unintentionally communicate with a host that the programmer did not anticipate.
Consider the following example of a web application:
```rb
require 'sinatra'
require 'httparty'
class RepositoryClient
include HTTParty
base_uri 'http://exmaple.test/api/v1/repositories/'
headers 'X-API-KEY' => '1234567890'
end
post '/issue' do
request_body = JSON.pars
Red Hat
httparty: Httparty: Server-Side Request Forgery (SSRF) allows information disclosure and unauthorized internal access.
vendor_redhat·2025-12-23·CVSS 8.8
CVE-2025-68696 [HIGH] CWE-918 httparty: Httparty: Server-Side Request Forgery (SSRF) allows information disclosure and unauthorized internal access.
httparty: Httparty: Server-Side Request Forgery (SSRF) allows information disclosure and unauthorized internal access.
httparty is an API tool. In versions 0.23.2 and prior, httparty is vulnerable to SSRF. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. This issue has been patched via commit 0529bcd.
A flaw was found in httparty, an API tool. This Server-Side Request Forgery (SSRF) vulnerability allows an attacker to trick the server into making requests to internal resources or other external domains on their behalf. This can lead to the disclosure of sensitive information, such as API keys, and enable unauthorized access to internal servers.
Statement: This vulnerability is rated Important for Red Hat as it aff
Debian
CVE-2025-68696: ruby-httparty - httparty is an API tool. In versions 0.23.2 and prior, httparty is vulnerable to...
vendor_debian·2025·CVSS 8.8
CVE-2025-68696 [HIGH] CVE-2025-68696: ruby-httparty - httparty is an API tool. In versions 0.23.2 and prior, httparty is vulnerable to...
httparty is an API tool. In versions 0.23.2 and prior, httparty is vulnerable to SSRF. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. This issue has been patched via commit 0529bcd.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 0.24.2-1)
sid: resolved (fixed in 0.24.2-1)
trixie: open
No detection rules found.
No public exploits indexed.
Wiz
CVE-2025-68696 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.8
CVE-2025-68696 [HIGH] CVE-2025-68696 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-68696 :
Ruby vulnerability analysis and mitigation
httparty is an API tool. In versions 0.23.2 and prior, httparty is vulnerable to SSRF. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. This issue has been patched via commit 0529bcd.
Source : NVD
## 8.8
Score
Published December 23, 2025
Severity HIGH
CNA Score 8.8
Affected Technologies
Ruby
Chainguard
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 18.9
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
gitlab-rails-ce-18.2
gitlab-rails-ce-18.4
Sources
NVD
Chainguard Has Fix Added at: Jan 11, 2026
Debian 11, 12, 13 Severity
Bugzilla
CVE-2025-68696 rubygem-httparty: Httparty: Server-Side Request Forgery (SSRF) allows information disclosure and unauthorized internal access. [fedora-42]
bugzilla·2025-12-24·CVSS 7.8
CVE-2025-68696 [HIGH] CVE-2025-68696 rubygem-httparty: Httparty: Server-Side Request Forgery (SSRF) allows information disclosure and unauthorized internal access. [fedora-42]
CVE-2025-68696 rubygem-httparty: Httparty: Server-Side Request Forgery (SSRF) allows information disclosure and unauthorized internal access. [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedo
2025-12-23
Published