GHSA-hm5p-x4rq-38w4
High · 8.2CVSS
8.2
EPSS
—
Published
Dec 23, 2025
CISA due date
—
The record
httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| RubyGems | httparty | 0 | 0.24.0 |
| Chainguard | gitlab-rails-ce-18.1 | 0 | 18.1.6-r3 |
| Chainguard | gitlab-rails-ce-18.2 | 0 | 18.2.8-r3 |
| Chainguard | gitlab-rails-ce-18.3 | 0 | 18.3.6-r2 |
| Chainguard | gitlab-rails-ce-18.4 | 0 | 18.4.6-r1 |
| Chainguard | gitlab-rails-ce-18.5 | 0 | 18.5.5-r0 |
| Chainguard | gitlab-rails-ce-18.6 | 0 | 18.6.3-r0 |
| Chainguard | gitlab-rails-ce-fips-18.3 | 0 | 18.3.6-r2 |
| Chainguard | gitlab-rails-ce-fips-18.6 | 0 | 18.6.3-r0 |
Related vulnerabilities
- CVE-2025-68696 httparty is an API tool. Same vulnerability
- CVE-2026-1182 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.14 before… Also affects gitlab-rails-ce-18.1
- CVE-2026-0595 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before… Also affects gitlab-rails-ce-18.1
- CVE-2025-3950 Exposure of Private Personal Information to an Unauthorized Actor in GitLab Also affects gitlab-rails-ce-18.1
- CVE-2025-10569 Allocation of Resources Without Limits or Throttling in GitLab Also affects gitlab-rails-ce-18.1
- CVE-2025-11246 Insufficient Granularity of Access Control in GitLab Also affects gitlab-rails-ce-18.1
- CVE-2025-61594 URI is a module providing classes to handle Uniform Resource Identifiers. Also affects gitlab-rails-ce-18.1
- CVE-2025-12029 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in… Also affects gitlab-rails-ce-18.1