~ / search / GHSA-c2f4-cvqm-65w2

GHSA-c2f4-cvqm-65w2

Puma HTTP Request/Response Smuggling vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-21647

Packages

EcosystemPackageAffectedFixed in
RubyGems puma >= 6.0.0, < 6.4.2 6.4.2
RubyGems puma < 5.6.8 5.6.8

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Prior to versions 6.4.2 and 5.6.8, puma exhibited dangerous behavior when parsing chunked transfer encoding bodies. Fixed versions limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. ### Patches The vulnerability has been fixed in 6.4.2 and 5.6.8. ### Workarounds No known workarounds. ### References * [HTTP Request Smuggling](https://portswigger.net/web-security/request-smuggling) * Open an issue in [Puma](https://github.com/puma/puma) * See our [security policy](https://github.com/puma/puma/security/policy)

References

External links from the advisory. They lead to third-party sites.