Zeddyu

The issue allows for HTTP request smuggling, which can be exploited. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

A flaw was found in the processing of invalid HTTP requests with large chunk sizes, allowing an attacker to take advantage of HTTP request smuggling.

Name of the Vulnerable Software and Affected Versions: Puma versions prior to 3.12.5 Puma versions prior to 4.3.4 Description: The issue is related to the handling of HTTP requests in Puma, a RubyGem for Ruby/Rack applications. An attacker could smuggle an HTTP response by using an invalid transfer-encoding header, potentially allowing a remote attacker to impact the integrity of information. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4. Recommendations: For Puma versions prior to 3.12.5, update to version 3.12.5 to resolve the issue. For Puma versions prior to 4.3.4, update to version 4.3.4 to resolve the issue.