--- title: CVE-2026-38969 (webrick): ruby webrick through v1.9.2... description: A security advisory (CVE-2026-38969) has been published for the Ruby WEBrick web server library through version 1.9.2. The vulnerability involves WEBrick... canonical: https://daily.dev/posts/cve-2026-38969-webrick-ruby-webrick-through-v1-9-2-webrick-reparses-trailer-fr6g4hilu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CVE-2026-38969 (webrick): ruby webrick through v1.9.2 WEBrick reparses trailer | daily.dev og:description: A security advisory (CVE-2026-38969) has been published for the Ruby WEBrick web server library through version 1.9.2. The vulnerability involves WEBrick... og:url: https://daily.dev/posts/cve-2026-38969-webrick-ruby-webrick-through-v1-9-2-webrick-reparses-trailer-fr6g4hilu og:image: https://api.daily.dev/og/posts/FR6G4hiLu.png og:image:alt: CVE-2026-38969 (webrick): ruby webrick through v1.9.2 WEBrick reparses trailer og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CVE-2026-38969 (webrick): ruby webrick through v1.9.2 WEBrick reparses trailer **[RUBYLAND](https://daily.dev/sources/rubyla)** · 1 min read · 0 upvotes · 0 comments ## Summary A security advisory (CVE-2026-38969) has been published for the Ruby WEBrick web server library through version 1.9.2. The vulnerability involves WEBrick reparsing trailer Content-Length headers into canonical request state, which enables HTTP request smuggling attacks. No patched versions are currently available. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-38969 in Ruby's WEBrick library? CVE-2026-38969 is a vulnerability in WEBrick through version 1.9.2 where the server reparses the Content-Length value found in an HTTP trailer into the canonical request state. This inconsistency between how the request length is initially parsed and how the trailer value overrides it can enable HTTP request smuggling attacks against applications using WEBrick. _Ruby developers tracking WEBrick security fixes can follow advisories like this one on daily.dev._ ### Is there a patched version of WEBrick available for CVE-2026-38969? No patched version is available for CVE-2026-38969 as of the advisory's publication on July 02, 2026. The vulnerability affects ruby webrick through version 1.9.2, and users should monitor for a fix given the request smuggling risk from trailer Content-Length reparsing. _Teams deciding how to respond to unpatched CVEs can watch for WEBrick updates via daily.dev._ ## Similar posts on daily.dev - [GHSA-42qh-8mx8-7wqm \(rack-proxy\): HTTP response smuggling via ambiguous backend response framing in rack-proxy 1.x](https://daily.dev/posts/ghsa-42qh-8mx8-7wqm-rack-proxy-http-response-smuggling-via-ambiguous-backend-response-framing-in--dgy8hoi4b) · RUBYLAND · 0 upvotes · 0 comments - [Improper parsing of W3C baggage headers may lead to DoS](https://daily.dev/posts/improper-parsing-of-w3c-baggage-headers-may-lead-to-dos-unmzdvdu5) · RUBYLAND · 0 upvotes · 0 comments - [Post Mortem: HTTP Request Smuggling Vulnerability](https://daily.dev/posts/post-mortem-http-request-smuggling-vulnerability-36fsdzezd) · Crystal · 7 upvotes · 0 comments - [CVE-2026-107715 \(mechanize\): Mechanize sends credential headers to another host after an HTTP redirect](https://daily.dev/posts/cve-2026-107715-mechanize-mechanize-sends-credential-headers-to-another-host-after-an-http-redire-eco5n4grr) · RUBYLAND · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ruby](https://daily.dev/tags/ruby) [View this post on daily.dev](https://daily.dev/posts/cve-2026-38969-webrick-ruby-webrick-through-v1-9-2-webrick-reparses-trailer-fr6g4hilu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CVE-2026-38969 (webrick): ruby webrick through v1.9.2 WEBrick reparses trailer","url":"https://daily.dev/posts/cve-2026-38969-webrick-ruby-webrick-through-v1-9-2-webrick-reparses-trailer-fr6g4hilu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cve-2026-38969-webrick-ruby-webrick-through-v1-9-2-webrick-reparses-trailer-fr6g4hilu"},"datePublished":"2026-07-06T14:23:30.940Z","dateModified":"2026-09-14T08:43:06.721Z","description":"A security advisory (CVE-2026-38969) has been published for the Ruby WEBrick web server library through version 1.9.2. The vulnerability involves WEBrick...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"RUBYLAND","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"RUBYLAND","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/rubyla","url":"https://daily.dev/sources/rubyla"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cve-2026-38969-webrick-ruby-webrick-through-v1-9-2-webrick-reparses-trailer-fr6g4hilu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ruby","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"RUBYLAND","item":"https://daily.dev/sources/rubyla"},{"@type":"ListItem","position":3,"name":"CVE-2026-38969 (webrick): ruby webrick through v1.9.2 WEBrick reparses trailer"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cve-2026-38969-webrick-ruby-webrick-through-v1-9-2-webrick-reparses-trailer-fr6g4hilu#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-38969 in Ruby's WEBrick library?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-38969 is a vulnerability in WEBrick through version 1.9.2 where the server reparses the Content-Length value found in an HTTP trailer into the canonical request state. This inconsistency between how the request length is initially parsed and how the trailer value overrides it can enable HTTP request smuggling attacks against applications using WEBrick. Ruby developers tracking WEBrick security fixes can follow advisories like this one on daily.dev."}},{"@type":"Question","name":"Is there a patched version of WEBrick available for CVE-2026-38969?","acceptedAnswer":{"@type":"Answer","text":"No patched version is available for CVE-2026-38969 as of the advisory's publication on July 02, 2026. The vulnerability affects ruby webrick through version 1.9.2, and users should monitor for a fix given the request smuggling risk from trailer Content-Length reparsing. Teams deciding how to respond to unpatched CVEs can watch for WEBrick updates via daily.dev."}}]} ```