httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage
Priority HIGH 73CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
httparty is an API tool. In versions 0.23.2 and prior, httparty is vulnerable to SSRF. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. This issue has been patched via commit 0529bcd.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00302 23rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed httparty (RubyGems): 0.24.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jnunemaker | httparty | up to 0.23.2 | — | No fix listed | CNA |
| — | httparty (RubyGems) | before 0.24.0 | 0.24.0 | Patch available | GHSA-hm5p-x4rq-38w4 |
- httparty Vendorjnunemaker Affected up to 0.23.2 Fixed in — No fix listed CNA
- httparty (RubyGems) Vendor— Affected before 0.24.0 Fixed in 0.24.0 Patch available GHSA-hm5p-x4rq-38w4
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jnunemaker:httparty:*:*:*:*:*:*:*:* | before 0.24.0 | Vulnerable | jnunemaker |
- cpe:2.3:a:jnunemaker:httparty:*:*:*:*:*:*:*:* Versions before 0.24.0 Vulnerable ·jnunemaker
Remediation
- Fix · GHSA-hm5p-x4rq-38w4 httparty (RubyGems) Fixed in 0.24.0 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2025-68696
- 2026-10-03 Alias added: GHSA-hm5p-x4rq-38w4
References
More jnunemaker Httparty vulnerabilities
- TI-2024-14667 httparty Multipart/Form-Data Request Tampering Vulnerability CVSS 3.1MEDIUM 5.3
- TI-2013-01587 The httparty gem 0.9.0 and earlier for Ruby does not properly restrict casts of string… CVSS 2.0HIGH 7.5
Sources
- CVE-2025-68696 · CVE Program
- CVE-2025-68696 · NVD
- FIRST EPSS
- GHSA-hm5p-x4rq-38w4 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-68696 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences