CVE-2019-16254: Medium severity ruby-lang Ruby vulnerability
Last updated 25 August 2025
Other sources
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-16254?
CVE-2019-16254 is a vulnerability in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 that allows HTTP Response Splitting.
How does CVE-2019-16254 work?
If an attacker inserts untrusted input into the response header of a program using WEBrick, they can exploit the vulnerability to insert a newline character and inject malicious content to deceive clients.
What is the severity of CVE-2019-16254?
CVE-2019-16254 has a severity rating of medium with a CVSS score of 5.3.
Which versions of Ruby are affected by CVE-2019-16254?
Ruby versions 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 are affected by CVE-2019-16254.
How can I fix CVE-2019-16254?
To fix CVE-2019-16254, update Ruby to version 2.4.8, 2.5.7, or 2.6.5 or later as appropriate for your version.