CVE-2024-21647

CVSS V2 None CVSS V3 None

Description

Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. This vulnerability has been fixed in versions 6.4.2 and 5.6.8.

Overview

CVE ID
CVE-2024-21647

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-01-08T13:45:27.510Z

Last Modified Date
2024-01-08T13:45:27.510Z

Weakness Enumerations

CWE	URL
CWE-444	http://cwe.mitre.org/data/definitions/444.html

References

Reference URL	Reference Tags
https://github.com/puma/puma/security/advisories/GHSA-c2f4-cvqm-65w2	x_refsource_CONFIRM
https://github.com/puma/puma/commit/5fc43d73b6ff193325e657a24ed76dec79133e93	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-21647
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21647

History

Created	Old Value	New Value	Data Type	Notes
2024-06-26 15:03:20				Added to TrackCVE