Skip to main content

Puma CVE-2026-68006

| EUVDEUVD-2026-75664 CRITICAL
HTTP Request/Response Smuggling (CWE-444)
2026-09-10 mitre GHSA-8vmp-v4pm-x3hq
RCE Ruby Red Hat Request Smuggling Suse Puma
9.1
CVSS 3.1 · Vendor: mitre
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify Puma behind a differing proxy
  2. Delivery
    Craft ambiguous/desynchronizing HTTP request
  3. Exploit
    Trigger parser interpretation mismatch
  4. Execution
    Smuggle second request past front end
  5. Impact
    Poison responses or hijack other users' requests

Vulnerability Assessment

Weakness
CWE
CWE-444
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service HTTP request consistency
Exploitation Conditions

Realistic exploitation of a CWE-444 flaw in Puma's http11_parser requires Puma to be deployed behind an HTTP intermediary (reverse proxy, CDN, or load balancer) whose request-boundary parsing diverges from Puma's, so that ambiguously-framed requests desynchronize the two - a standalone Puma instance with no differing front end substantially limits impact. No authentication or user interaction is needed to send the requests (PR:N/UI:N), but the requirement for a specific proxy/backend parsing mismatch makes real-world exploitation deployment-dependent and non-trivial (AC:H). Note the description's 'arbitrary code execution' claim is unverified and inconsistent with request smuggling; defenders should confirm actual impact with Puma maintainers before treating it as RCE.
Impact

Signals conflict sharply and the sourcing is weak, so raw severity should be discounted. The vendor CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) implies a trivially remote, unauthenticated critical flaw, but the assigned weakness is CWE-444 (Inconsistent Interpretation of HTTP Requests / request smuggling), while the description asserts 'execute arbitrary code' - those two are not compatible, since request smuggling yields request injection/cache poisoning/auth bypass, not native code execution. The RCE claim is therefore not credible and should be verified with the Puma maintainers. EPSS is very low (0.17%, 6th percentile), there is no CISA KEV listing, and no genuine POC - the only reference is an issue in an unrelated personal GitHub repo (czx1111/cve), not the Puma project or a vendor advisory, and the CPE is 'n/a:n/a' with EUVD versions 'n/a n/a'. Net: no public exploit identified at time of analysis; treat as a plausible-but-poorly-substantiated request-smuggling issue in a very widely deployed product rather than a confirmed critical RCE. Prioritize patching to Puma 8.0.3 as hygiene given Puma's ubiquity in Rails deployments, but the 9.1 headline is not supported by the available evidence.
Exploit ScenarioDerived

An attacker sends crafted, ambiguously-framed HTTP requests to a Puma server sitting behind a reverse proxy or load balancer whose HTTP parsing differs from Puma's http11_parser, causing the front end and Puma to disagree on request boundaries. The smuggled request is then interpreted as a separate request, enabling request injection, cache poisoning, or bypass of front-end access controls affecting other users' sessions. No public exploit code has been identified; the sole reference is an unverified third-party GitHub issue.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 17, 2026

HTTP request smuggling via inconsistent request framing in Puma's native http11_parser (reported range Puma 5.0.0 through 8.0.3) allows a remote, unauthenticated attacker to desynchronize request boundaries between Puma and an upstream HTTP intermediary, enabling request hijacking, cache poisoning, or bypass of front-end access controls; the description's claim of arbitrary code execution is unverified and inconsistent with CWE-444. Exploitation is deployment-dependent: it requires a reverse proxy, CDN, or load balancer whose parsing of ambiguous Content-Length/Transfer-Encoding framing diverges from Puma's, which is why our independent assessment rates it AV:N/AC:H/PR:N/UI:N/S:C rather than the published 9.1. Risk signals are weak and conflicting - EPSS is 0.17% (6th percentile), there is no CISA KEV listing and no confirmed public exploit code, and the only third-party reference is an unverified GitHub issue - so raw severity should be discounted.

RemediationAI

No vendor-released patch is identified in the provided data: the reference set contains no Puma security advisory, no GitHub PR/commit, and no exact fixed version, and the description's version phrasing does not establish that 8.0.3 is the fix - confirm status with the Puma maintainers and monitor Puma release notes and Ruby advisory channels before assuming any version is safe. Until a fix is confirmed, apply specific compensating controls at the intermediary: enforce unambiguous HTTP/1.1 framing so that only one message-length mechanism is honored (reject or normalize requests that carry both Transfer-Encoding and Content-Length, duplicate/conflicting Content-Length, non-standard or obfuscated Transfer-Encoding tokens, and obs-fold/whitespace variants), and enable the request-smuggling hardening options in nginx, HAProxy, Envoy, or your CDN - the trade-off is that some non-conformant clients will start receiving 400 responses. Disable backend connection reuse/keep-alive between the proxy and Puma (set Connection: close or short upstream keepalive timeouts) so a smuggled prefix cannot be re-attached to another user's request; this costs latency and throughput and may increase Puma worker churn. Where feasible, restrict network access so only the proxy can reach Puma's listener, and terminate all client traffic at a single, consistently configured front end. Given the weak EPSS signal (0.17%) and the absence of KEV or confirmed exploit code, these mitigations can be prioritized against higher-confidence exposure, but they should be scheduled rather than dismissed because the impact ceiling of a successful desync (session hijacking, cache poisoning, auth bypass) is high.

Affected VersionsENISA

n/a n/a

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Puma is a Ruby application server; ext/puma_http11/http11_parser.rl is the Ragel-generated state machine for the C-based HTTP/1.1 request parser exposed to Ruby through the puma_http11 native extension. CWE-444 (Inconsistent Interpretation of HTTP Requests, i.e. request smuggling/desync) arises when two HTTP processors disagree on where a request ends - for example differing treatment of duplicate or obfuscated Content-Length headers, both Content-Length and Transfer-Encoding present, non-standard Transfer-Encoding tokens, or whitespace/obs-fold variations. When Puma's parser and an upstream proxy normalize these differently, the attacker's payload can be prepended to the next pipelined request on a reused backend connection, affecting another user's request. The parser is a pure framing component, so memory-corruption or code-execution outcomes are not a natural consequence of a CWE-444 defect; the advisory's 'arbitrary code execution' wording is therefore treated as unsubstantiated and the realistic impact ceiling is request desynchronization with changed scope (S:C), as reflected in the assessed vector AC:H. Note that the CPE mapping in the intelligence feed is unpopulated (n/a:n/a) and EUVD lists affected versions as 'n/a n/a', so exact affected build/version boundaries have not been independently corroborated and should be confirmed with the vendor.

Know when Puma gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mitre) PRIMARY 9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI 8.7 HIGH

Request smuggling is remote/unauthenticated (AV:N/PR:N) but needs a proxy/backend parsing divergence (AC:H) and crosses a trust boundary to affect other requests/users (S:C), with confidentiality and integrity impact and no availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N
SUSE 7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat 9.1 HIGH

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

3
CVSS changed
Sep 14, 2026 - 19:22 NVD
9.1 (CRITICAL)
CVE Published
Sep 10, 2026 - 00:00 cve.org
UNKNOWN (no severity yet)
CVE Published
Sep 10, 2026 - 00:00 cve.org
CRITICAL 9.1

DescriptionCVE.org

An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file

Executive ViewAI

Why It Matters

CVE-2026-68006 is a critical-rated request smuggling flaw in Puma's native http11_parser (reported range 5.0.0 through 8.0.3) that lets an unauthenticated remote attacker desynchronize request boundaries between Puma and a front-end HTTP intermediary, potentially enabling request hijacking, cache poisoning, or bypass of front-end access controls on internet-facing applications. Only organizations running Puma behind a reverse proxy, CDN, or load balancer whose request framing diverges from Puma's are exposed, so exposure is architecture-dependent rather than universal. No vendor patch is currently available, and with no confirmed exploitation and low exploit-probability signals, leadership should prioritize targeted architectural mitigations over a broad emergency response.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: enforce strict RFC 7230/9112 request framing at the front-end reverse proxy, CDN, or load balancer (reject requests containing both Content-Length and Transfer-Encoding, or duplicate/conflicting framing headers); normalize and validate all inbound framing headers before forwarding; disable backend keep-alive/connection reuse between the intermediary and Puma; isolate Puma instances from untrusted or non-normalizing intermediaries where feasible; and monitor for request-smuggling indicators such as anomalous 400/502 rates, cache-key mismatches, or unexplained request duplication.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
High
Puma is the default application server for most Ruby on Rails deployments
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.2%
Patch available No
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

46
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +46
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

HTTP Request Smuggling HIGH

HTTP request smuggling exploits inconsistencies in how front-end and back-end servers parse HTTP message boundaries.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

More in Puma

View all
CVE-2023-40175 CRITICAL
9.8 Aug 18

Puma is a Ruby/Rack web server built for parallelism. Rated critical severity (CVSS 9.8), this vulnerability is remotely
CVE-2022-24790 HIGH
7.5 Mar 30

Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. Rated high severity (CVSS 7
CVE-2021-29509 HIGH
7.5 May 11

Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. Rated high severity (CVSS 7.5), this vulnerability is r
CVE-2020-11077 HIGH
7.5 May 22

In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a
CVE-2020-11076 HIGH
7.5 May 22

In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-enco
CVE-2020-5247 HIGH
7.5 Feb 28

In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response head
CVE-2019-16770 HIGH
7.5 Dec 05

In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reac
CVE-2020-5249 MEDIUM
6.5 Mar 02

In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header,
CVE-2017-8943 MEDIUM
5.9 May 15

The PUMA PUMATRAC app 3.0.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle

CVE-2024-45614 MEDIUM
5.4 Sep 19

Puma is a Ruby/Rack web server built for parallelism. Rated medium severity (CVSS 5.4), this vulnerability is remotely e
CVE-2021-41136 LOW
3.7 Oct 12

Puma is a HTTP 1.1 server for Ruby/Rack applications. Rated low severity (CVSS 3.7), this vulnerability is remotely expl
CVE-2024-21647 MEDIUM
5.9 Jan 08

Puma is a web server for Ruby/Rack applications built for parallelism. Rated medium severity (CVSS 5.9), this vulnerabil

Same weakness CWE-444 – HTTP Request/Response Smuggling

View all
CVE-2023-41265 CRITICAL POC
9.9
CVE-2026-88773 CRITICAL POC
9.3
CVE-2026-48710 MEDIUM POC
6.5
CVE-2021-33037 MEDIUM
5.3
CVE-2021-23336 MEDIUM POC
5.9
CVE-2025-55315 CRITICAL POC
9.9
CVE-2018-3907 CRITICAL POC
10.0
CVE-2024-10264 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected
SUSE Linux Enterprise High Availability Extension 16.1 Not-Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-68006 REF https://github.com/czx1111/cve/issues/1

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy