The SentinelOne Annual Threat Report - A Defenders Guide from the FrontlinesThe SentinelOne Annual Threat ReportGet the Report
Experiencing a Breach?Blog
Get StartedContact Us
SentinelOne
  • Platform
    Platform Overview
    • Singularity Platform
      Welcome to Integrated Enterprise Security
    • AI for Security
      Leading the Way in AI-Powered Security Solutions
    • Securing AI
      Accelerate AI Adoption with Secure AI Tools, Apps, and Agents.
    • How It Works
      The Singularity XDR Difference
    • Singularity Marketplace
      One-Click Integrations to Unlock the Power of XDR
    • Pricing & Packaging
      Comparisons and Guidance at a Glance
    Data & AI
    • Purple AI
      Accelerate SecOps with Generative AI
    • Singularity Hyperautomation
      Easily Automate Security Processes
    • AI-SIEM
      The AI SIEM for the Autonomous SOC
    • AI Data Pipelines
      Security Data Pipeline for AI SIEM and Data Optimization
    • Singularity Data Lake
      AI-Powered, Unified Data Lake
    • Singularity Data Lake for Log Analytics
      Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
    Endpoint Security
    • Singularity Endpoint
      Autonomous Prevention, Detection, and Response
    • Singularity XDR
      Native & Open Protection, Detection, and Response
    • Singularity RemoteOps Forensics
      Orchestrate Forensics at Scale
    • Singularity Threat Intelligence
      Comprehensive Adversary Intelligence
    • Singularity Vulnerability Management
      Application & OS Vulnerability Management
    • Singularity Identity
      Identity Threat Detection and Response
    Cloud Security
    • Singularity Cloud Security
      Block Attacks with an AI-Powered CNAPP
    • Singularity Cloud Native Security
      Secure Cloud and Development Resources
    • Singularity Cloud Workload Security
      Real-Time Cloud Workload Protection Platform
    • Singularity Cloud Data Security
      AI-Powered Threat Detection for Cloud Storage
    • Singularity Cloud Security Posture Management
      Detect and Remediate Cloud Misconfigurations
    Securing AI
    • Prompt Security
      Secure AI Tools Across Your Enterprise
  • Why SentinelOne?
    Why SentinelOne?
    • Why SentinelOne?
      Cybersecurity Built for What’s Next
    • Our Customers
      Trusted by the World’s Leading Enterprises
    • Industry Recognition
      Tested and Proven by the Experts
    • About Us
      The Industry Leader in Autonomous Cybersecurity
    Compare SentinelOne
    • Arctic Wolf
    • Broadcom
    • CrowdStrike
    • Cybereason
    • Microsoft
    • Palo Alto Networks
    • Sophos
    • Splunk
    • Trellix
    • Trend Micro
    • Wiz
    Verticals
    • Energy
    • Federal Government
    • Finance
    • Healthcare
    • Higher Education
    • K-12 Education
    • Manufacturing
    • Retail
    • State and Local Government
  • Services
    Managed Services
    • Managed Services Overview
      Wayfinder Threat Detection & Response
    • Threat Hunting
      World-Class Expertise and Threat Intelligence
    • Managed Detection & Response
      24/7/365 Expert MDR Across Your Entire Environment
    • Incident Readiness & Response
      DFIR, Breach Readiness, & Compromise Assessments
    Support, Deployment, & Health
    • Technical Account Management
      Customer Success with Personalized Service
    • SentinelOne GO
      Guided Onboarding & Deployment Advisory
    • SentinelOne University
      Live and On-Demand Training
    • Services Overview
      Comprehensive Solutions for Seamless Security Operations
    • SentinelOne Community
      Community Login
  • Partners
    Our Network
    • MSSP Partners
      Succeed Faster with SentinelOne
    • Singularity Marketplace
      Extend the Power of S1 Technology
    • Cyber Risk Partners
      Enlist Pro Response and Advisory Teams
    • Technology Alliances
      Integrated, Enterprise-Scale Solutions
    • SentinelOne for AWS
      Hosted in AWS Regions Around the World
    • Channel Partners
      Deliver the Right Solutions, Together
    • SentinelOne for Google Cloud
      Unified, Autonomous Security Giving Defenders the Advantage at Global Scale
    • Partner Locator
      Your Go-to Source for Our Top Partners in Your Region
    Partner Portal→
  • Resources
    Resource Center
    • Case Studies
    • Data Sheets
    • eBooks
    • Reports
    • Videos
    • Webinars
    • Whitepapers
    • Events
    View All Resources→
    Blog
    • Feature Spotlight
    • For CISO/CIO
    • From the Front Lines
    • Identity
    • Cloud
    • macOS
    • SentinelOne Blog
    Blog→
    Tech Resources
    • SentinelLABS
    • Ransomware Anthology
    • Cybersecurity 101
  • About
    About SentinelOne
    • About SentinelOne
      The Industry Leader in Cybersecurity
    • Investor Relations
      Financial Information & Events
    • SentinelLABS
      Threat Research for the Modern Threat Hunter
    • Careers
      The Latest Job Opportunities
    • Press & News
      Company Announcements
    • Cybersecurity Blog
      The Latest Cybersecurity Threats, News, & More
    • FAQ
      Get Answers to Our Most Frequently Asked Questions
    • DataSet
      The Live Data Platform
    • S Foundation
      Securing a Safer Future for All
    • S Ventures
      Investing in the Next Generation of Security, Data and AI
  • Pricing
Get StartedContact Us
CVE Vulnerability Database
Vulnerability Database/CVE-2025-68696

CVE-2025-68696: Jnunemaker Httparty SSRF Vulnerability

CVE-2025-68696 is a Server-Side Request Forgery vulnerability in Jnunemaker Httparty that risks API key leaks and unauthorized internal server access. This article covers technical details, affected versions, and mitigation.

Updated: May 15, 2026

CVE-2025-68696 Overview

CVE-2025-68696 is a Server-Side Request Forgery (SSRF) vulnerability affecting the httparty Ruby gem, a widely used HTTP client library for consuming REST APIs. The flaw is present in versions 0.23.2 and prior. An attacker who controls request parameters can coerce applications using httparty into issuing arbitrary requests to internal infrastructure or unintended external endpoints. The maintainers patched the issue in commit 0529bcd.

Critical Impact

Exploitation can leak API keys and credentials, and allow unauthenticated attackers to pivot HTTP requests to internal services that are otherwise unreachable from the public network.

Affected Products

  • jnunemaker/httparty versions 0.23.2 and prior
  • Ruby applications and gems that depend on vulnerable httparty releases
  • Downstream services that pass user-controlled URLs or parameters into HTTParty request methods

Discovery Timeline

  • 2025-12-23 - CVE-2025-68696 published to the National Vulnerability Database (NVD)
  • 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-68696

Vulnerability Analysis

The weakness is classified as [CWE-918] Server-Side Request Forgery. httparty accepts URLs and follows redirects when issuing HTTP calls. Versions 0.23.2 and earlier do not adequately constrain the destination of outbound requests when handling certain inputs. An attacker who supplies a malicious URL or triggers a redirect chain can cause the application to send requests to hosts the attacker chooses.

This behavior becomes a security problem when httparty runs inside server-side workflows that proxy URLs supplied by clients, fetch remote resources for previews, or perform webhook callbacks. Sensitive headers, including bearer tokens and API keys configured on the HTTParty client, can be transmitted to attacker-controlled destinations. The same primitive enables probing of cloud metadata endpoints, internal admin interfaces, and other resources reachable from the application host.

Root Cause

The root cause is insufficient validation of request destinations within the HTTP request pipeline. The library does not enforce an allow-list of hosts or schemes and does not strip authentication material when redirects cross trust boundaries. The fix landed in commit 0529bcd and tightens how the library resolves and forwards requests.

Attack Vector

The vulnerability is exploitable over the network with no authentication and no user interaction. A typical attack path involves submitting a URL pointing at an internal address such as http://169.254.169.254/latest/meta-data/ or http://127.0.0.1:8080/admin, or supplying an external URL that returns a 30x redirect to such an address. The httparty client follows the redirect and returns the internal response, or leaks request headers to the attacker's server. See the GitHub Security Advisory GHSA-hm5p-x4rq-38w4 for additional technical context.

Detection Methods for CVE-2025-68696

Indicators of Compromise

  • Outbound HTTP requests from application hosts to RFC1918 ranges, loopback addresses, or cloud metadata IPs such as 169.254.169.254
  • Application logs showing HTTParty requests to URLs derived from user input, followed by responses containing internal hostnames or instance metadata fields
  • Unexpected redirect chains where httparty follows a public URL to an internal address

Detection Strategies

  • Inventory Ruby applications and identify dependencies on httparty at versions <= 0.23.2 using bundle list or software composition analysis tooling
  • Inspect application code for calls such as HTTParty.get(params[:url]) where request destinations originate from untrusted input
  • Correlate egress proxy logs with application identity to flag requests targeting private IP space

Monitoring Recommendations

  • Alert on any outbound traffic from web tiers to link-local (169.254.0.0/16) or loopback destinations
  • Capture and review redirect responses (Location headers) returned to backend HTTP clients
  • Monitor for API key or token strings appearing in egress traffic to untrusted domains

How to Mitigate CVE-2025-68696

Immediate Actions Required

  • Upgrade httparty to the version containing commit 0529bcd or later across all Ruby applications and CI pipelines
  • Audit every call site that passes user-controlled URLs to HTTParty and apply strict allow-list validation
  • Rotate API keys and tokens that may have been transmitted through vulnerable clients in shared or multi-tenant environments

Patch Information

The maintainers fixed the SSRF in commit 0529bcd. Update Gemfile constraints to require a patched release, run bundle update httparty, and redeploy. Confirm transitive dependencies are not pinning a vulnerable version by inspecting Gemfile.lock.

Workarounds

  • Enforce egress filtering at the network layer to block application servers from reaching internal IP ranges and cloud metadata endpoints
  • Validate destination URLs in application code by resolving the host and rejecting private, loopback, and link-local addresses before invoking HTTParty
  • Disable automatic redirect following by passing follow_redirects: false and validate each hop explicitly when redirects are required
bash
# Update httparty in a Bundler-managed Ruby project
bundle update httparty
bundle list | grep httparty

# Verify the installed version is patched
ruby -e "require 'httparty'; puts HTTParty::VERSION"

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

  • Vulnerability Details
  • TypeSSRF

  • Vendor/TechHttparty

  • SeverityHIGH

  • CVSS Score7.8

  • EPSS Probability0.07%

  • Known ExploitedNo
  • CVSS Vector
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • Impact Assessment
  • ConfidentialityLow
  • IntegrityNone
  • AvailabilityNone
  • CWE References
  • CWE-918
  • Vendor Resources
  • GitHub Commit Update

  • GitHub Security Advisory GHSA-hm5p-x4rq-38w4
  • Latest CVEs
  • CVE-2026-46333: Linux Kernel Privilege Escalation Flaw

  • CVE-2026-2586: Eclipse Glassfish RCE Vulnerability

  • CVE-2026-2587: Eclipse Glassfish RCE Vulnerability

  • CVE-2026-45255: FreeBSD bsdinstall/bsdconfig RCE Flaw
Default Legacy - Prefooter | Experience the World’s Most Advanced Cybersecurity Platform

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne
  • Get Started
  • Get a Demo
  • Product Tour
  • Why SentinelOne
  • Pricing & Packaging
  • FAQ
  • Contact
  • Contact Us
  • Customer Support
  • SentinelOne Status
  • Language
  • Platform
  • Singularity Platform
  • Singularity Endpoint
  • Singularity Cloud
  • Singularity AI-SIEM
  • Singularity Identity
  • Singularity Marketplace
  • Purple AI
  • Services
  • Wayfinder TDR
  • SentinelOne GO
  • Technical Account Management
  • Support Services
  • Verticals
  • Energy
  • Federal Government
  • Finance
  • Healthcare
  • Higher Education
  • K-12 Education
  • Manufacturing
  • Retail
  • State and Local Government
  • Cybersecurity for SMB
  • Resources
  • Blog
  • Labs
  • Case Studies
  • Videos
  • Product Tours
  • Events
  • Cybersecurity 101
  • eBooks
  • Webinars
  • Whitepapers
  • Press
  • News
  • Ransomware Anthology
  • Company
  • About Us
  • Our Customers
  • Careers
  • Partners
  • Legal & Compliance
  • Security & Compliance
  • Investor Relations
  • S Foundation
  • S Ventures

©2026 SentinelOne, All Rights Reserved.

Privacy Notice Terms of Use

English