Read the docs

puma

Records15All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high9CVSS 7.0–8.9

Exploited now

puma records in CISA KEV

No puma vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Puma 12 records MEDIUM Pumatrac 1 record LOW

Records

15 records

TI-2022-08603 CVE-2022-24790 · GHSA-h99w-9q5r-gjq9

HTTP Request Smuggling in puma

Priority MEDIUM 52

Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02191 Published 2022-03-30 Partial fix · 4.3.12, 5.6.4 CWE-444
TI-2022-07686 CVE-2022-23634 · GHSA-rmj8-8hhh-gv5h

Information Exposure when using Puma with Rails

Priority MEDIUM 41

Puma is a Ruby/Rack web server built for parallelism.

CVSS 3.1HIGH 8.0 Network No auth User interaction EPSS 0.02107 Published 2022-02-11 Partial fix · 5.6.2, 4.3.11 CWE-200
TI-2020-08950 CVE-2020-11076 · GHSA-x7jg-6pwg-fx5h

HTTP Smuggling via Transfer-Encoding Header in Puma

Priority MEDIUM 40

In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04088 Published 2020-05-22 Partial fix · 3.12.5, 4.3.4 CWE-444
TI-2020-08951 CVE-2020-11077 · GHSA-w64w-qqph-5gxm

HTTP Smuggling via Transfer-Encoding Header in Puma

Priority LOW 38

In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02877 Published 2020-05-22 Partial fix · 3.12.6, 4.3.5 CWE-444
TI-2020-04303 CVE-2020-5247 · GHSA-84j7-475p-hp8v

HTTP Response Splitting in Puma

Priority LOW 38

In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02549 Published 2020-02-28 Partial fix · 3.12.3, 4.3.2 +2 CWE-113
TI-2019-12551 CVE-2019-16770 · GHSA-7xx3-m584-x994

Potential DOS attack in Puma

Priority LOW 37

In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02014 Published 2019-12-05 Partial fix · 4.3.1, 3.12.2 CWE-770
TI-2024-14372 CVE-2024-21647 · GHSA-c2f4-cvqm-65w2

HTTP Request/Response Smuggling in puma

Priority LOW 35

Puma is a web server for Ruby/Rack applications built for parallelism.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00958 Published 2024-01-08 Partial fix · 5.6.8, 6.4.2 CWE-444
TI-2020-04305 CVE-2020-5249 · GHSA-33vf-4xgg-9r58

HTTP Response Splitting (Early Hints) in Puma

Priority LOW 32

In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, suc…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.01571 Published 2020-03-02 Partial fix · 3.12.4, 4.3.3 CWE-113
Open these records in search →