Gazelle versions through 0.49 incorrectly prioritize Content‑Length over Transfer‑Encoding: chunked when both headers are present, violating RFC 7230 §3.3.3 (CWE‑444: Improper Header Precedence). This flaw allows an attacker to smuggle additional HTTP requests through a front‑end reverse proxy, potentially enabling injection of arbitrary requests, bypass of filters, or exploitation of downstream services.

The vulnerability affects Kazeburo’s Gazelle web server versions up to and including 0.49. The flaw is fixed in later releases of Starman (0.4018 or newer) and can also be remedied by applying the available patch from the Perl CPAN repository.

The CVSS score of 7.5 indicates a high severity, and no EPSS score is published. The flaw enables hidden request smuggling: an attacker with access to the front‑end proxy could inject malicious traffic without being detected. The issue is not listed in CISA’s KEV catalog, but the potential impact on confidentiality, integrity, and availability of downstream systems makes it a high‑risk vulnerability. Exploitation does not require privileged credentials and can be performed remotely by sending crafted HTTP requests that contain both headers.