Read the docs
TI-2022-07686 Aliases CVE-2022-23634GHSA-rmj8-8hhh-gv5h

Information Exposure when using Puma with Rails

Priority MEDIUM 41CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Information disclosure, Denial of service
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 2 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200 and CWE-404.

Summary

Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02107 81st percentileScored 2026-11-07
Fix Partial puma (puma): 5.6.2, 4.3.11puma (RubyGems): 5.6.2, 4.3.11Red Hat: 1 advisoryRed Hat: 2 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pumapuma5.0.0 to before 5.6.2; before 4.3.115.6.2, 4.3.11Patch availableCNA
—puma (RubyGems)5.0.0 to before 5.6.25.6.2Patch availableGHSA-rmj8-8hhh-gv5h
—puma (RubyGems)before 4.3.114.3.11Patch availableGHSA-rmj8-8hhh-gv5h
  • puma Vendorpuma Affected 5.0.0 to before 5.6.2; before 4.3.11 Fixed in 5.6.2, 4.3.11 Patch available CNA
  • puma (RubyGems) Vendor— Affected 5.0.0 to before 5.6.2 Fixed in 5.6.2 Patch available GHSA-rmj8-8hhh-gv5h
  • puma (RubyGems) Vendor— Affected before 4.3.11 Fixed in 4.3.11 Patch available GHSA-rmj8-8hhh-gv5h

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:puma:puma:*:*:*:*:*:ruby:*:*before 4.3.11; 5.0.0 to before 5.6.2Vulnerablepuma
cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*5.0.0 to before 5.2.6.2; 6.0.0 to before 6.0.4.6; 6.1.0 to before 6.1.4.6; 7.0.0 to before 7.0.2.2VulnerableRails
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*37VulnerableFedoraproject
  • cpe:2.3:a:puma:puma:*:*:*:*:*:ruby:*:* Versions before 4.3.11; 5.0.0 to before 5.6.2 Vulnerable ·puma
  • cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* Versions 5.0.0 to before 5.2.6.2; 6.0.0 to before 6.0.4.6; 6.1.0 to before 6.1.4.6; 7.0.0 to before 7.0.2.2 Vulnerable ·Rails
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA puma (puma) Fixed in 5.6.2, 4.3.11
  • Fix · GHSA-rmj8-8hhh-gv5h puma (RubyGems) Fixed in 5.6.2 Advisory →
  • Fix · GHSA-rmj8-8hhh-gv5h puma (RubyGems) Fixed in 4.3.11 Advisory →

Red Hat 1 advisory

  • RHSA-2022:5498 Released 2022-07-05 · Red Hat rating Moderate
    Satellite 6.11 Release
    • Red Hat Satellite 6.11 for RHEL 7 candlepin-4.1.13-1.el7sat, foreman-3.1.1.21-2.el7sat, libsolv-0.7.22-1.el7pc +4
    • Red Hat Satellite 6.11 for RHEL 8 candlepin-4.1.13-1.el8sat, foreman-3.1.1.21-2.el8sat, libsolv-0.7.22-1.el8pc +8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
CloudForms Management Engine 5AffectedNo fix planned: Will not fix
Red Hat Satellite 6AffectedNo fix yet
Red Hat Satellite 6.11 for RHEL 7Fixed RHSA-2022:5498
Red Hat Satellite 6.11 for RHEL 8Fixed RHSA-2022:5498
Not affected: 3 products
  • Red Hat Satellite 6.11 for RHEL 7
  • Red Hat Satellite 6.11 for RHEL 8
  • Red Hat Storage 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23634
  2. 2026-10-03 Alias added: GHSA-rmj8-8hhh-gv5h

References

Patch 3

Advisory 10

Other 5

  • TI-2022-08603 HTTP Request Smuggling in puma CVSS 3.1CRITICAL 9.1
  • TI-2023-21048 Inconsistent Interpretation of HTTP Requests in puma CVSS 3.1CRITICAL 9.8
  • TI-2020-08950 HTTP Smuggling via Transfer-Encoding Header in Puma CVSS 3.1HIGH 7.5
  • TI-2020-08951 HTTP Smuggling via Transfer-Encoding Header in Puma CVSS 3.1HIGH 7.5
  • TI-2020-04303 HTTP Response Splitting in Puma CVSS 3.1HIGH 7.5
  • TI-2019-12551 Potential DOS attack in Puma CVSS 3.1HIGH 7.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences