CVE-2019-16254
Status: ModifiedMedium (5.3)—
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Base score: 5.3
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 4.57%
- Percentile among all scored CVEs: 91
- Score date: 10/6/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (2)
CWEs
- CWE-74
References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html
- https://hackerone.com/reports/331984
- https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html
- https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html
- https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html
- https://seclists.org/bugtraq/2019/Dec/31
- https://seclists.org/bugtraq/2019/Dec/32
- https://security.gentoo.org/glsa/202003-06
- https://www.debian.org/security/2019/dsa-4586
- https://www.debian.org/security/2019/dsa-4587
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.ruby-lang.org/ja/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254/
- https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-4-8-released/
- https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-5-7-released/
- https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-6-5-released/
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html
- https://hackerone.com/reports/331984
- https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html
- https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html
- https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html
- https://seclists.org/bugtraq/2019/Dec/31
- https://seclists.org/bugtraq/2019/Dec/32
- https://security.gentoo.org/glsa/202003-06
- https://www.debian.org/security/2019/dsa-4586
- https://www.debian.org/security/2019/dsa-4587
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.ruby-lang.org/ja/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254/
- https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-4-8-released/
- https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-5-7-released/
- https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-6-5-released/
Raw JSON (NVD)
Show
{
"id": "CVE-2019-16254",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 1.4,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2019-11-26T18:15:15.210",
"references": [
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html",
"source": "cve@mitre.org"
},
{
"url": "https://hackerone.com/reports/331984",
"tags": [
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html",
"source": "cve@mitre.org"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html",
"source": "cve@mitre.org"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html",
"source": "cve@mitre.org"
},
{
"url": "https://seclists.org/bugtraq/2019/Dec/31",
"source": "cve@mitre.org"
},
{
"url": "https://seclists.org/bugtraq/2019/Dec/32",
"source": "cve@mitre.org"
},
{
"url": "https://security.gentoo.org/glsa/202003-06",
"source": "cve@mitre.org"
},
{
"url": "https://www.debian.org/security/2019/dsa-4586",
"source": "cve@mitre.org"
},
{
"url": "https://www.debian.org/security/2019/dsa-4587",
"source": "cve@mitre.org"
},
{
"url": "https://www.oracle.com/security-alerts/cpujan2020.html",
"source": "cve@mitre.org"
},
{
"url": "https://www.ruby-lang.org/ja/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254/",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-4-8-released/",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-5-7-released/",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-6-5-released/",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://hackerone.com/reports/331984",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://seclists.org/bugtraq/2019/Dec/31",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://seclists.org/bugtraq/2019/Dec/32",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.gentoo.org/glsa/202003-06",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.debian.org/security/2019/dsa-4586",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.debian.org/security/2019/dsa-4587",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.oracle.com/security-alerts/cpujan2020.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.ruby-lang.org/ja/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-4-8-released/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-5-7-released/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-6-5-released/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-74"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF."
},
{
"lang": "es",
"value": "Ruby versiones hasta 2.4.7, versiones 2.5.x hasta 2.5.6 y versiones 2.6.x hasta 2.6.4, permite HTTP Response Splitting. Si un programa que utiliza WEBrick inserta información no segura en el encabezado de respuesta, un atacante puede explotarlo para insertar un carácter newline para dividir un encabezado e inyectar contenido malicioso para engañar a los clientes. NOTA: este problema se presenta debido a una solución incompleta de CVE-2017-17742, que abordó el vector CRLF, pero no abordó un CR aislado o un LF aislado."
}
],
"lastModified": "2026-06-17T02:22:00.470",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A6EFA741-C6E9-4362-AE58-785B0053A2A7",
"versionEndIncluding": "2.3.0"
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A2C45233-D18A-47C8-8D49-BB05ADD50D88",
"versionEndIncluding": "2.4.7",
"versionStartIncluding": "2.4.0"
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6E259007-36E1-418F-8493-A5A7928129F6",
"versionEndIncluding": "2.5.6",
"versionStartIncluding": "2.5.0"
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E746C3E0-0162-4487-AB58-2579B2BE1FD4",
"versionEndIncluding": "2.6.4",
"versionStartIncluding": "2.6.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}