CVE-2025-68696: jnunemaker httparty Server-Side Request Forgery (SSRF)
CVSS: 8.2v3.1HighAnalyzed
AliasesUBUNTU-CVE-2025-68696DEBIAN-CVE-2025-68696CGA-23j5-2f8c-53gcCGA-2pxv-j8fh-qvwwCGA-2r74-3gh2-h7jvCGA-33xp-8hg7-3hjwCGA-3486-cpg6-2hwcCGA-43fh-hj7c-jc57CGA-48hq-2667-86rfCGA-54x3-j2jq-fj92CGA-7h26-pr45-mpg4CGA-896v-9v96-4jc3CGA-8x9v-8jcp-2m74CGA-95r9-938r-8g95CGA-9f6p-65wh-6244CGA-f997-jpgh-r49vCGA-ffpg-v79w-frp6CGA-g43f-978p-wq83CGA-g676-9gwg-crppCGA-g7c8-jpvm-fjh5CGA-h64r-8827-wh42CGA-h743-x2f2-m42xCGA-hrqr-fmm8-xvhpCGA-hw2v-545h-c229CGA-jm78-4vc3-jfr4CGA-mwgc-6mm4-6c9hGHSA-hm5p-x4rq-38w4CGA-q74j-wmqw-gx55CGA-qcq2-qmjq-qp9hCGA-qj7m-f4f7-96hcCGA-r24g-frf3-xh9wCGA-r5cx-64qm-m38vCGA-rmhr-hcf9-hq8hCGA-rww4-frh6-q5w9CGA-v2wr-h8rq-84mqCGA-vfrx-3h9c-wchvCGA-vp97-gj3v-mpfhCGA-xgw2-q252-3278CGA-xj3j-w9rx-ch2w
Published 23-12-2025Last modified 24-12-2025
Vulnerability summary
CVE-2025-68696 is a high (CVSS 8.2) Server-Side Request Forgery (SSRF) vulnerability in jnunemaker httparty. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.7% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.2/10
010
High · v3.1 (NVD)EPSS score
0.30%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 0 · Related 2Timeline
- 23-12-2025PublishedVulnerability first disclosed.
- 24-12-2025Last modifiedVulnerability information updated.
Description
httparty is an API tool. In versions 0.23.2 and prior, httparty is vulnerable to SSRF. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. This issue has been patched via commit 0529bcd.
CVSS metrics
9 scores · 6 sources · 2 versionsHigh 7.8Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:PSources5 sources · 7.8–8.8
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:PDiffers
- OSV · ChainguardEcosystem advisory · calculated8.8HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:PDiffers
- OSV · RubygemsEcosystem advisory · calculated8.8HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:PDiffers
- NVDNIST7.8HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 8.2Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- OSV · DebianEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- OSV · RubygemsEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS trend
Probability
0.30%
Chance of exploitation in the next 30 days
Percentile
22%
Versus all other CVEs
30-day change
0.00 pp
From 0.30% on 21-09-2026
21-09-202621-10-2026
EPSS score0.30%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundHttparty
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard16 products
- gitlab-rails-ce-18.1All versions (No fix recorded)
- gitlab-rails-ce-18.2All versions (No fix recorded)
- gitlab-rails-ce-18.3All versions (No fix recorded)
- gitlab-rails-ce-18.4All versions (No fix recorded)
- gitlab-rails-ce-18.5All versions (No fix recorded)
Debian1 product
- ruby-httpartyAll versions (No fix recorded) | < 0.24.2-1
Jnunemaker1 product
- httparty≤ 0.23.2 | < 0.24.0
RubyGems1 product
- httparty< 0.24.0
Ubuntu1 product
- ruby-httpartyAll versions (No fix recorded)
5 vendors · 20 products
References
9 links- github.com/jnunemaker/httparty/security/advisories/GHSA-hm5p-x4rq-38w4X Refsource CONFIRMREPORTAdvisoryWEBExploitVendor Advisory
- github.com/jnunemaker/httparty/commit/0529bcd6309c9fd9bfdd50ae211843b10054c240X Refsource MISCREPORTFIXWEBPatch
