CVE-2023-40175

Name of the Vulnerable Software and Affected Versions Puma versions prior to 6.3.1 Puma versions prior to 5.6.7

Description The issue is related to incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers, allowing HTTP request smuggling. This could be caused by either incorrect parsing of trailing fields in chunked transfer encoding bodies or by parsing of blank/zero-length Content-Length headers. The severity of this issue is highly dependent on the nature of the web site using Puma.

Recommendations For versions prior to 6.3.1, upgrade to version 6.3.1 or later. For versions prior to 5.6.7, upgrade to version 5.6.7 or later. As a temporary workaround, consider restricting access to vulnerable API endpoints until a patch is available. Avoid using blank or zero-length Content-Length headers in HTTP requests until the issue is resolved.