CVE-2024-21647 Overview
CVE-2024-21647 affects Puma, a web server for Ruby and Rack applications built for parallelism. Versions prior to 6.4.2 and 5.6.8 parse chunked transfer encoding bodies incorrectly, enabling HTTP request smuggling [CWE-444]. The flaw stems from Puma not limiting the size of chunk extensions during request parsing. An attacker can send specially crafted chunked requests that consume unbounded CPU and network bandwidth, leading to denial of service. The maintainers fixed the issue by enforcing a size limit on chunk extensions in Puma 6.4.2 and 5.6.8.
Critical Impact
Remote, unauthenticated attackers can exhaust server CPU and network bandwidth through unbounded chunk extension parsing, degrading or disabling Ruby/Rack application availability.
Affected Products
- Puma versions prior to 5.6.8
- Puma versions 6.0.0 through 6.4.1
- Ruby/Rack applications deployed behind affected Puma releases
Discovery Timeline
- 2024-01-08 - CVE-2024-21647 published to the National Vulnerability Database
- 2025-11-03 - Last updated in NVD database
Technical Details for CVE-2024-21647
Vulnerability Analysis
The vulnerability is an HTTP Request Smuggling weakness classified as [CWE-444], Inconsistent Interpretation of HTTP Requests. Puma processes chunked transfer encoding bodies in a way that differs from how upstream proxies and load balancers parse the same requests. The HTTP/1.1 chunked encoding format permits optional chunk extensions following a semicolon on each chunk size line. Puma did not bound the length of these extensions, allowing attackers to submit arbitrarily large extension data per chunk.
When a front-end proxy and Puma disagree on request boundaries, an attacker can inject a second request inside the body of a first. Downstream, Puma may treat the smuggled bytes as a new request from the same connection. Beyond smuggling, parsing oversized extensions forces the server to scan large byte ranges, producing unbounded resource consumption.
Root Cause
The root cause is missing input validation on chunk extension length in Puma's HTTP parser. The parser accepted any number of bytes between the semicolon and CRLF terminating each chunk header. The fix introduces an explicit upper bound on chunk extension size, rejecting requests that exceed it before allocating further resources.
Attack Vector
An unauthenticated remote attacker sends a crafted HTTP request with a chunked body containing oversized chunk extensions. No user interaction is required. The attack vector is network-based with low complexity. The vulnerability requires Puma to be reachable directly or through a proxy that forwards chunked bodies without normalization. EPSS data indicates an exploit probability of 0.958% at the 56th percentile.
For technical specifics, see the Puma Security Advisory GHSA-c2f4-cvqm-65w2 and the upstream patch commit.
Detection Methods for CVE-2024-21647
Indicators of Compromise
- HTTP requests containing chunked bodies with abnormally long chunk extensions following the semicolon delimiter on chunk size lines
- Sustained spikes in Puma worker CPU usage correlated with requests using Transfer-Encoding: chunked
- Discrepancies between request counts logged by upstream proxies and Puma access logs on the same connections
Detection Strategies
- Inspect HTTP request payloads at a reverse proxy or web application firewall for chunked bodies whose chunk size lines exceed reasonable byte thresholds
- Alert on Ruby application servers running Puma versions earlier than 5.6.8 or 6.4.2 through software bill of materials and dependency scanning
- Correlate elevated network ingress with low response throughput on Puma listener ports as a signal of resource exhaustion
Monitoring Recommendations
- Enable verbose access logging on front-end proxies to capture raw Transfer-Encoding headers and request sizes
- Track Puma worker process CPU and memory metrics, alerting on sustained saturation by a single connection
- Continuously inventory Ruby gem versions in production through SCA tooling to identify vulnerable Puma installations
How to Mitigate CVE-2024-21647
Immediate Actions Required
- Upgrade Puma to version 6.4.2 if running the 6.x branch, or to 5.6.8 if running the 5.x branch
- Audit Ruby application deployments and Gemfile lockfiles for pinned Puma versions below the fixed releases
- Place Puma behind a reverse proxy such as nginx or HAProxy configured to normalize chunked transfer encoding
Patch Information
The fix is committed in puma/puma@5fc43d7 and shipped in Puma 6.4.2 and 5.6.8. Debian users should apply updates referenced in the Debian LTS Announcement. Update the Puma gem with bundle update puma after adjusting Gemfile constraints, then redeploy application workers.
Workarounds
- Terminate HTTP at a hardened reverse proxy that enforces strict limits on chunk extension length and rejects malformed chunked encodings
- Configure a web application firewall rule to drop requests whose chunk size lines exceed a small fixed byte budget
- Restrict direct network exposure of Puma to trusted upstream proxies through firewall rules or security groups
# Update Puma to a patched release
bundle update puma --conservative
bundle list | grep puma # Confirm puma (>= 6.4.2) or (>= 5.6.8, < 6.0.0)
# Restart application workers
sudo systemctl restart puma
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
