Puma is a lightweight, widely embedded Ruby application server that sits in the request-handling path of many web applications and frameworks. Its vulnerability profile centers on HTTP protocol-handling and resource-management issues—particularly HTTP request smuggling, request-header injection, injection flaws, resource exhaustion, and authorization bypass—that reflect the demands of parsing untrusted network input and managing request state. Defenders should monitor Puma releases closely given its prevalence in Ruby-on-Rails deployments and the request-path criticality of such flaws; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Puma over time
Signals from CVEs in this vendor scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-40175CRITICAL Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-le | Aug 18, 2023 | 9.8 | 29 | NO | NO |
CVE-2022-24790HIGH Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP r | Mar 30, 2022 | 7.5 | 26 | NO | NO |
CVE-2020-11076HIGH In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and P | May 22, 2020 | 7.5 | 26 | NO | NO |
CVE-2019-16770HIGH In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive | Dec 5, 2019 | 7.5 | 26 | NO | NO |
CVE-2021-29509HIGH Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already be | May 11, 2021 | 7.5 | 25 | NO | NO |
CVE-2024-21647HIGH Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a | Jan 8, 2024 | 7.5 | 23 | NO | NO |
CVE-2022-23634MEDIUM Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, d | Feb 11, 2022 | 5.9 | 22 | NO | NO |
CVE-2020-5249MEDIUM In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the | Mar 2, 2020 | 6.5 | 21 | NO | NO |
CVE-2017-8943MEDIUM The PUMA PUMATRAC app 3.0.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information | May 15, 2017 | 5.9 | 21 | NO | NO |
CVE-2020-11077HIGH In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses | May 22, 2020 | 7.5 | 20 | NO | NO |
Signals from CVEs in this vendor scope (13 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Puma.
Media articles that mention a CVE ID that affects a product developed by Puma — matched by CVE ID, not by vendor name.