CVE-2024-21647

Name of the Vulnerable Software and Affected Versions Puma versions prior to 6.4.2 Puma versions prior to 5.6.8

Description The issue is related to the incorrect handling of HTTP requests in Puma, a web server for Ruby/Rack applications. This can lead to HTTP request smuggling, allowing an attacker to cause unbounded resource consumption, including CPU and network bandwidth. The vulnerability is due to the lack of limits on chunk extensions when parsing chunked transfer encoding bodies.

Recommendations For versions prior to 6.4.2, update to version 6.4.2 or later. For versions prior to 5.6.8, update to version 5.6.8 or later. As a temporary workaround, consider restricting access to the vulnerable HTTP endpoint until a patch is applied. Avoid using the vulnerable chunked transfer encoding feature in the affected Puma versions until the issue is resolved.