CVE-2024-21647

Summary

CVE-2024-21647 is a vulnerability affecting the Puma web server used for Ruby/Rack applications. Before version 6.4.2, Puma displayed incorrect behavior when interpreting chunked transfer encoding bodies, leading to HTTP request smuggling. This issue allowed attackers to cause unlimited resource consumption, including CPU and network bandwidth. The flaw has been rectified in versions 6.4.2 and 5.6.8 by implementing a limit on the size of chunk extensions.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.