CVE-2017-17742

It was found that WEBrick did not sanitize headers sent back to clients, resulting in a response-splitting vulnerability. An attacker, able to control the server’s headers, could force WEBrick into injecting additional headers to a client.

Mitigation

The server can manually sanitize possibly untrusted headers prior to inserting them in the reply.