---
id: CVE-2024-47220
title: An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby
summary: >-
  An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It
  allows HTTP request smuggling by providing both a Content-Length header and a
  Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST
  /user HTT…
severity: none
published: '2024-09-22'
updated: '2026-07-17'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-47220'
references:
  - url: 'https://github.com/ruby/webrick/issues/145'
    label: cve@mitre.org
  - url: 'https://github.com/ruby/webrick/issues/145#issuecomment-2369994610'
    label: cve@mitre.org
  - url: 'https://github.com/ruby/webrick/issues/145#issuecomment-2372838285'
    label: cve@mitre.org
  - url: >-
      https://github.com/ruby/webrick/pull/146/commits/d88321da45dcd230ac2b4585cad4833d6d5e8841
    label: cve@mitre.org
tags:
  - nvd
epss: 0.00393
epssPercentile: 0.31627
ingestedAt: '2026-07-17T17:13:26.474Z'
---

## Overview

An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's position is "Webrick should not be used in production."

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.