Description
EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Openstack-optools 13 | rubygem-em-http-request | 1.1.5-4.el7ost | RHSA-2021:0937 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | em-http-request | < 1.1.6 | 1.1.6 | GHSA-q27f-v3r6-9v77 |
Advisories 1
- RHSA-2021:0937 Red Hat Security Advisory: rubygem-em-http-request security update Red Hat Security Advisories (RHSA) · Nov 22, 2025