CVE-2025-68696

HighCVSS 8.2

Published: 23/12/2025(UTC)Updated: 19/10/2026(UTC)Translated: 20/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

The httparty library in versions 0.23.2 and prior is vulnerable to SSRF (Server-Side Request Forgery). This can lead to leaking API keys and allow third parties to issue requests to internal servers. The issue has been patched via commit 0529bcd.

Risk Assessment

An attacker can use the application to make requests to internal resources, risking API key leakage and access to internal services. This can breach the organization's network boundaries.

Recommendation

Update httparty to a version containing the fix (commit 0529bcd or later). Consider restricting outbound requests from the application to trusted addresses.

Other vulnerabilities in httparty

CVE-2024-22049Medium
A vulnerability in httparty before version 0.21.0 allows an attacker to manipulate filenames during multipart/form-data uploads. A remote, unauthenticated attacker can provide a crafted filename parameter, leading to the writing of attacker-controlled filenames.

Original NVD description (English source)

httparty is an API tool. In versions 0.23.2 and prior, httparty is vulnerable to SSRF. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. This issue has been patched via commit 0529bcd.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS