{"id":"CVE-2024-47220","title":"An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby","summary":"An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., \"GET /admin HTTP/1.1\\r\\n\" inside of a \"POST /user HTT…","severity":"none","published":"2024-09-22","updated":"2026-07-17","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-47220","references":[{"url":"https://github.com/ruby/webrick/issues/145","label":"cve@mitre.org"},{"url":"https://github.com/ruby/webrick/issues/145#issuecomment-2369994610","label":"cve@mitre.org"},{"url":"https://github.com/ruby/webrick/issues/145#issuecomment-2372838285","label":"cve@mitre.org"},{"url":"https://github.com/ruby/webrick/pull/146/commits/d88321da45dcd230ac2b4585cad4833d6d5e8841","label":"cve@mitre.org"}],"tags":["nvd"],"epss":0.00393,"epssPercentile":0.31627,"ingestedAt":"2026-07-17T17:13:26.474Z","slug":"CVE-2024-47220","body":"## Overview\n\nAn issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., \"GET /admin HTTP/1.1\\r\\n\" inside of a \"POST /user HTTP/1.1\\r\\n\" request. NOTE: the supplier's position is \"Webrick should not be used in production.\"\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}