-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| protocol-http1 | rubygems | < 0.15.1 | 0.15.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper validation of Content-Length and chunk size formats. In chunked.rb, the read method previously converted chunk sizes to integers without validating they were proper hex strings, allowing invalid prefixes. In connection.rb, extract_content_length used lenient Integer conversion that accepted '+', hexadecimal '0x' prefixes, and negative values. The commit added strict regex validators (VALID_CHUNK_LENGTH and VALID_CONTENT_LENGTH) to these functions to enforce RFC compliance.