Description
httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | httparty | ≤ 0.20.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-httparty | 0.21.0-1 | — |
| Debian 13 | ruby-httparty | 0.21.0-1 | — |
| Debian 12 | ruby-httparty | 0.21.0-1 | — |
| Debian 11 | ruby-httparty | 0.18.1-2+deb11u1 | DLA-3900-1 |
| Debian 10 | ruby-httparty | 0.16.2+dfsg1-3+deb10u1 | DLA-3716-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | ruby-httparty | No fix yet | — |
| Ubuntu 20.04 LTS | ruby-httparty | No fix yet | — |
| Ubuntu 18.04 LTS | ruby-httparty | No fix yet | — |
| Ubuntu 16.04 LTS | ruby-httparty | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | httparty | < 0.21.0 | 0.21.0 | GHSA-5pq7-52mg-hr42 |
Advisories 2
- DLA-3900-1 ruby-httparty - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3716-1 ruby-httparty - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- GitHub Security Advisory (GHSA-5pq7-52mg-hr42) vendor-advisory
- https://github.com/jnunemaker/httparty/commit/cdb45a678c43e44570b4e73f84b1abeb5ec22b8e patch
- https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43 related
- GitHub Security Advisory (GHSA-5pq7-52mg-hr42) vendor-advisory
- https://vulncheck.com/advisories/vc-advisory-GHSA-5pq7-52mg-hr42 third-party-advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOWECZPJY6JZIA5FSBJR77KCRDXWDZDA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4LDGAVPR4KB72V4GGQCWODEAI72QZI3V/
- https://lists.debian.org/debian-lts-announce/2024/01/msg00011.html