KAZEBURO Gazelle versions through 0.49 for Perl contain an HTTP Request Smuggling vulnerability caused by inconsistent interpretation of HTTP headers. Specifically, the software prioritizes the Content-Length header over the Transfer-Encoding: chunked header when both are included in a request, contrary to RFC 7230 3.3.3, which mandates that Transfer-Encoding must take precedence. This allows an attacker to craft specially formed HTTP requests that can be smuggled past front-end reverse proxies, potentially leading to request desynchronization and related impacts.

The vulnerability allows an attacker to perform HTTP Request Smuggling attacks by exploiting the incorrect header precedence. This can lead to bypassing security controls implemented by front-end reverse proxies, potentially enabling unauthorized request injection or manipulation. However, no known exploits have been reported in the wild, and the exact impact depends on the deployment context and presence of vulnerable proxies.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing compensating controls at the proxy or network level to detect and block malformed HTTP requests that contain conflicting Content-Length and Transfer-Encoding headers.