Puma

CVE-2026-68006 Sep 10, 00:00 CRITICAL Act Now

HTTP request smuggling via inconsistent request framing in Puma's native http11_parser (reported range Puma 5.0.0 through 8.0.3) allows a remote, unauthenticated attacker to desynchronize request boundaries between Puma and an upstream HTTP intermediary, enabling request hijacking, cache poisoning, or bypass of front-end access controls; the description's claim of arbitrary code execution is unverified and inconsistent with CWE-444. Exploitation is deployment-dependent: it requires a reverse proxy, CDN, or load balancer whose parsing of ambiguous Content-Length/Transfer-Encoding framing diverges from Puma's, which is why our independent assessment rates it AV:N/AC:H/PR:N/UI:N/S:C rather than the published 9.1. Risk signals are weak and conflicting - EPSS is 0.17% (6th percentile), there is no CISA KEV listing and no confirmed public exploit code, and the only third-party reference is an unverified GitHub issue - so raw severity should be discounted.

CVE-2024-45614 Sep 19, 23:15 Ruby MEDIUM PATCH This Month

Puma is a Ruby/Rack web server built for parallelism. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

CVE-2024-21647 Jan 08, 14:15 Ruby MEDIUM PATCH This Month

Puma is a web server for Ruby/Rack applications built for parallelism. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.

CVE-2023-40175 Aug 18, 22:15 Ruby CRITICAL PATCH Act Now

Puma is a Ruby/Rack web server built for parallelism. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.

CVE-2022-24790 Mar 30, 22:15 Ruby HIGH PATCH This Week

Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.

CVE-2021-41136 Oct 12, 16:15 Ruby LOW PATCH Monitor

Puma is a HTTP 1.1 server for Ruby/Rack applications. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.

CVE-2021-29509 May 11, 17:15 Ruby HIGH PATCH This Week

Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

CVE-2020-11077 May 22, 15:15 Ruby HIGH PATCH This Week

In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-11076 May 22, 15:15 Ruby HIGH PATCH This Week

In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.

CVE-2020-5249 Mar 02, 16:15 Ruby MEDIUM PATCH This Month

In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-5247 Feb 28, 17:15 Ruby HIGH PATCH This Week

In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2019-16770 Dec 05, 20:15 Ruby HIGH PATCH This Week

In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2017-8943 May 15, 18:29 MEDIUM This Month

The PUMA PUMATRAC app 3.0.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.