AIKIDO-2026-373367

TL;DR

rack-proxy forwards the client request body to the backend using body_stream = source_request.body, an unbounded stream that is not truncated to the request's declared Content-Length, so bytes beyond that length ride along on the same backend connection. Net::HTTP forwards the whole stream regardless of the declared size, letting trailing bytes appear to the backend as the start of a second request smuggled past the proxy. The fix validates the client Content-Length and bounds the forwarded body to that length with a new RequestBodyStream.