Puma up to 5.6.6/6.3.0 Chunked Transfer Encoding request smuggling

Summaryinfo

A vulnerability, which was classified as critical, has been found in Puma up to 5.6.6/6.3.0. Impacted is an unknown function of the component Chunked Transfer Encoding Handler. The manipulation leads to request smuggling. This vulnerability is traded as CVE-2023-40175. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Puma up to 5.6.6/6.3.0. This issue affects an unknown functionality of the component Chunked Transfer Encoding Handler. The manipulation with an unknown input leads to a request smuggling vulnerability. Using CWE to declare the problem leads to CWE-444. The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is highly dependent on the nature of the web site using puma is. This could be caused by either incorrect parsing of trailing fields in chunked transfer encoding bodies or by parsing of blank/zero-length Content-Length headers. Both issues have been addressed and this vulnerability has been fixed in versions 6.3.1 and 5.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The weakness was shared 08/19/2023 as GHSA-68xg-gqqm-vgj8. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2023-40175 since 08/09/2023. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 269712 (SUSE SLES15 Security Update : rubygem-puma (SUSE-SU-2025:03466-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.6.7 or 6.3.1 eliminates this vulnerability. Applying the patch 690155e7d644b80eeef0a6094f9826ee41f1080a is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (269712). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Puma

Version

• 5.6.0
• 5.6.1
• 5.6.2
• 5.6.3
• 5.6.4
• 5.6.5
• 5.6.6
• 6.0
• 6.1
• 6.2
• 6.3.0

License

• open-source

Website

• Product: https://github.com/puma/puma/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion