debian/ruby-httparty vulnerabilities

Latest debian/ruby-httparty CVEs

Newest publication first

1. CVE-2025-68696 httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage

   Published 2025-12-23

   High·CVSS 7.8 PoC

   httparty is an API tool. In versions 0.23.2 and prior, httparty is vulnerable to SSRF. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. This issue has been patched via commit 0529bcd.

2. DLA-3900-1 ruby-httparty - security update

   Published 2024-09-28

   Unknown

3. DLA-3716-1 ruby-httparty - security update

   Published 2024-01-23

   Unknown

4. CVE-2024-22049 httparty Multipart/Form-Data Request Tampering Vulnerability

   Published 2024-01-04

   Medium·CVSS 5.3 PoC

   httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.