Executive brief
Puma is a widely-used web server that processes HTTP requests from clients and proxies. Due to a bug in its HTTP header parser, an attacker can send specially-crafted requests with underscores in header names (e.g., Transfer_Encoding instead of Transfer-Encoding) that Puma fails to recognize, while upstream proxies or CDNs may still process them. This disagreement allows an attacker to inject hidden requests into the connection stream, bypassing access controls, poisoning caches, or stealing session data from legitimate users.
Technical details
The vulnerability is an HTTP request smuggling flaw in Puma's HTTP/1.1 parser caused by inconsistent header name normalization. The C extension function snake_upcase_char (in ext/puma_http11/http11_parser.rl) converts underscores in header names to commas (e.g., Transfer_Encoding becomes TRANSFER,ENCODING), but the body-parsing logic in setup_body (lib/puma/client.rb) only checks for standard names with underscores (HTTP_TRANSFER_ENCODING, CONTENT_LENGTH). The UNMASKABLE_HEADERS allowlist preserves comma-containing keys without normalizing them back, causing setup_body to fail header lookups. If a front-end proxy (nginx, AWS ALB) accepts underscore headers and interprets them normally, the proxy and Puma will desynchronize on request boundaries, enabling CL.TE (Content-Length vs. Transfer-Encoding) and CL.CL smuggling attacks. Patches are available in Puma 8.0.3, 7.2.2, and 6.4.4.
Affected products
- Puma Puma 5.0.0 through 8.0.2
Timeline
- 2026-07-29: disclosed
- 2026-09-10: advisory
- 2026: patched: Puma 8.0.3, 7.2.2, 6.4.4