Caddy · Caddy · CVE-2022-24790
**Name of the Vulnerable Software and Affected Versions**
Puma versions prior to 4.3.12
Puma versions prior to 5.6.4
**Description**
The issue is related to the handling of HTTP requests in Puma, a server for Ruby/Rack applications. When Puma is used behind a proxy that does not properly validate incoming HTTP requests according to the RFC7230 standard, it may lead to a disagreement between Puma and the frontend proxy on where a request starts and ends. This can allow requests to be smuggled via the front-end proxy to Puma. The vulnerability is associated with lenient parsing of `Transfer-Encoding` headers, `Content-Length` headers, and chunk sizes, as well as the ending of chunked segments.
**Recommendations**
For Puma versions prior to 4.3.12, upgrade to version 4.3.12 or later.
For Puma versions prior to 5.6.4, upgrade to version 5.6.4 or later.
As a temporary workaround, when deploying a proxy in front of Puma, turn on any and all functionality to ensure that the request matches the RFC7230 standard. Consider using proxy servers known to have "good" behavior regarding this standard, such as Nginx, Apache, Haproxy 2.5+, Caddy, or Traefik, to minimize the risk of exploitation.