AIKIDO-2026-373367

TL;DR

rack-proxy forwards the client request body to the backend using body_stream = source_request.body, an unbounded stream that is not truncated to the request's declared Content-Length, so bytes beyond that length ride along on the same backend connection. Net::HTTP forwards the whole stream regardless of the declared size, letting trailing bytes appear to the backend as the start of a second, request smuggled past the proxy. The proxy also accepted backend responses with ambiguous or duplicate Transfer-Encoding/Content-Length framing without rejecting them, letting the same desynchronization technique work from the backend side. The fix validates the client Content-Length, bounds the forwarded body to that length with a new RequestBodyStream, and rejects backend responses with ambiguous framing.