AIKIDO-2026-58381

TL;DR

rack-proxy forwards a backend response's Content-Length even when the same response also carries Transfer-Encoding, so Net::HTTP dechunks the body while rack-proxy keeps the stale backend-supplied length. A compromised or attacker-influenced backend can set this length shorter than the dechunked body, letting the surplus bytes be read as a separate HTTP response on a reused connection. This affects both the default streaming mode and streaming: false, and can poison a shared connection's response queue for downstream intermediaries or caches. The fix rejects any backend response carrying both headers with 502 before forwarding it, closes the backend connection on rejection, and strips response headers named by backend Connection fields.