Vulnerability · Published Aug 4, 2023 · Assigned by GitHub_M
CVE-2023-38697 protocol-http1 HTTP Request/Response Smuggling vulnerability
Medium 5.8
In plain English
A medium-severity security flaw in protocol-http1 from socketry. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
protocol-http1 provides a low-level implementation of the HTTP/1 protocol. RFC 9112 Section 7.1 defined the format of chunk size, chunk data and chunk extension. The value of Content-Length header should be a string of 0-9 digits, the chunk size should be a string of hex digits and should split from chunk data using CRLF, and the chunk extension shouldn't contain any invisible character. However, Falcon has following behaviors while disobey the corresponding RFCs: accepting Content-Length header values that have `+` prefix, accepting Content-Length header values that written in hexadecimal with `0x` prefix, accepting `0x` and `+` prefixed chunk size, and accepting LF in chunk extension. This behavior can lead to desync when forwarding through multiple HTTP parsers, potentially results in HTTP request smuggling and firewall bypassing. This issue is fixed in `protocol-http1` v0.15.1. There are no known workarounds.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ruby-protocol-http1 | no fix listed | DEBIAN-CVE-2023-38697 |
| Debian:14 | ruby-protocol-http1 | 0.35.2-1 | DEBIAN-CVE-2023-38697 |
| RubyGems | protocol-http1 | 0.15.1 | GHSA-6jwc-qr2q-7xwj |
| Ubuntu:22.04:LTS | ruby-protocol-http1 | no fix listed | UBUNTU-CVE-2023-38697 |
| Ubuntu:24.04:LTS | ruby-protocol-http1 | no fix listed | UBUNTU-CVE-2023-38697 |
| Ubuntu:25.10 | ruby-protocol-http1 | no fix listed | UBUNTU-CVE-2023-38697 |
| Ubuntu:26.04:LTS | ruby-protocol-http1 | no fix listed | UBUNTU-CVE-2023-38697 |
| Ubuntu:26.10 | ruby-protocol-http1 | no fix listed | UBUNTU-CVE-2023-38697 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| socketry | protocol-http1 | < 0.15.1 |
Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
References
- https://github.com/socketry/protocol-http1/security/advisories/GHSA-6jwc-qr2q-7xwj x_refsource_CONFIRM
- https://github.com/socketry/protocol-http1/pull/20 x_refsource_MISC
- https://github.com/socketry/protocol-http1/commit/e11fc164fd2b36f7b7e785e69fa8859eb06bcedd x_refsource_MISC
- https://www.rfc-editor.org/rfc/rfc9112#name-chunked-transfer-coding x_refsource_MISC