CVE-2025-68696 httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage
An SSRF vulnerability in the httparty Ruby library allows attackers to leak API keys and access internal servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68696?
CVE-2025-68696 is a high-severity server-side request forgery vulnerability in jnunemaker httparty, published on 23 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
httparty is an API tool. In versions 0.23.2 and prior, httparty is vulnerable to SSRF. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. This issue has been patched via commit 0529bcd.
Weakness: CWE-918
Which versions are affected by CVE-2025-68696?
2 open source packages ship an affected version, including httparty. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
httparty RubyGems | All versions | 0.24.0 |
httparty RubyGems | All versions | 0.24.0 |
Products include Jnunemaker Httparty.
How do I fix CVE-2025-68696?
Upgrade httparty to 0.24.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-68696 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-68696 exists.
Other vulnerabilities in jnunemaker httparty
Sources
Also known as DEBIAN-CVE-2025-68696, GHSA-hm5p-x4rq-38w4, UBUNTU-CVE-2025-68696.