CVE-2025-68696

8.2 HIGH
Published: December 23, 2025 Modified: January 07, 2026
View on NVD

Description

httparty is an API tool. In versions 0.23.2 and prior, httparty is vulnerable to SSRF. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. This issue has been patched via commit 0529bcd.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://github.com/jnunemaker/httparty/commit/0529bcd6309c9fd9bfdd50ae211843b10054c240
Source: security-advisories@github.com
Patch
https://github.com/jnunemaker/httparty/security/advisories/GHSA-hm5p-x4rq-38w4
Source: security-advisories@github.com
Exploit Vendor Advisory
https://github.com/jnunemaker/httparty/security/advisories/GHSA-hm5p-x4rq-38w4
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Exploit Vendor Advisory

3 reference(s) from NVD

Quick Stats

CVSS v3 Score
8.2 / 10.0
EPSS (Exploit Probability)
0.1%
19th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-918

Affected Vendors

jnunemaker

Related CVEs

CVE-2026-4624 7.3
CVE-2026-4623 7.3
CVE-2026-33308 6.8
CVE-2026-3079 6.5
CVE-2026-33307 7.5