PT-2023-6141 · Puma+7 · Puma+7
Kenballus
·
Published
2023-08-18
·
Updated
2025-10-07
·
CVE-2023-40175
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Puma versions prior to 6.3.1
Puma versions prior to 5.6.7
Description
The issue is related to incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers, allowing HTTP request smuggling. This could be caused by either incorrect parsing of trailing fields in chunked transfer encoding bodies or by parsing of blank/zero-length Content-Length headers. The severity of this issue is highly dependent on the nature of the web site using Puma.
Recommendations
For versions prior to 6.3.1, upgrade to version 6.3.1 or later.
For versions prior to 5.6.7, upgrade to version 5.6.7 or later.
As a temporary workaround, consider restricting access to vulnerable API endpoints until a patch is available.
Avoid using blank or zero-length Content-Length headers in HTTP requests until the issue is resolved.
Exploit
Fix
DoS
HTTP Request/Response Smuggling
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Puma
Red Os
Suse
Ubuntu