CVE-2017-17742

CVE-2017-17742 is a medium-severity vulnerability in Ruby-lang Ruby with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-113.

Key facts

• Severity: Medium (CVSS 3.x base score 5.3)
• CVSS v2: 5.0
• EPSS exploit prediction: 6% (92nd percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-113
• Affected product: Ruby-lang Ruby
• Published: 2018-04-03
• Last modified: 2026-06-17

Description

Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.

Frequently asked questions

What is CVE-2017-17742?

Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.

How severe is CVE-2017-17742?

CVE-2017-17742 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2017-17742 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 6% (92nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2017-17742?

CVE-2017-17742 primarily affects Ruby-lang Ruby. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2017-17742?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2017-17742 published?

CVE-2017-17742 was published on 2018-04-03 and last updated on 2026-06-17.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
• http://www.securityfocus.com/bid/103684
• http://www.securitytracker.com/id/1042004
• https://access.redhat.com/errata/RHSA-2018:3729
• https://access.redhat.com/errata/RHSA-2018:3730
• https://access.redhat.com/errata/RHSA-2018:3731
• https://access.redhat.com/errata/RHSA-2019:2028
• https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html
• https://lists.debian.org/debian-lts-announce/2018/04/msg00024.html
• https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
• https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html
• https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html
• https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html
• https://usn.ubuntu.com/3685-1/
• https://www.debian.org/security/2018/dsa-4259
• https://www.ruby-lang.org/en/news/2018/03/28/http-response-splitting-in-webrick-cve-2017-17742/
• https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released/
• https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/
• https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/
• https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/

Affected products (3)

• cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
• cpe:2.3:a:ruby-lang:ruby:2.6.0:preview1:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

More vulnerabilities in Ruby-lang Ruby

• CVE-2009-4124 — Critical (CVSS 10.0): Heap-based buffer overflow in the rb_str_justify function in string.c in Ruby 1.9.1 before 1.9.1-p376 allows…
• CVE-2008-2662 — Critical (CVSS 10.0): Multiple integer overflows in the rb_str_buf_append function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6…
• CVE-2008-2663 — Critical (CVSS 10.0): Multiple integer overflows in the rb_ary_store function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6…
• CVE-2016-2338 — Critical (CVSS 9.8): An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In…
• CVE-2022-28738 — Critical (CVSS 9.8): A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to…
• CVE-2011-4121 — Critical (CVSS 9.8): The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value…

All CVEs affecting Ruby-lang Ruby →

Other CWE-113 (HTTP Response Splitting) vulnerabilities

• CVE-2026-38967 — Critical (CVSS 9.8): CrowCpp Crow through v1.3.1 HTTP is vulnerable to response header injection via unvalidated response header values.
• CVE-2026-34520 — Critical (CVSS 9.1): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser…
• CVE-2025-53007 — High (CVSS 8.9): arduino-esp32 provides an Arduino core for the ESP32. Versions prior to 3.3.0-RC1 and 3.2.1 contain a HTTP Response…
• CVE-2024-52875 — High (CVSS 8.8): An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the…
• CVE-2018-0689 — High (CVSS 8.8): HTTP header injection vulnerability in SEIKO EPSON printers and scanners (DS-570W firmware versions released prior to…
• CVE-2018-11347 — High (CVSS 8.8): The YunoHost 2.7.2 through 2.7.14 web application is affected by one HTTP Response Header Injection. This flaw allows…

Browse all CWE-113 (HTTP Response Splitting) vulnerabilities →