Header normalization allows for client to clobber proxy set headers in Puma
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-639.
Summary
Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy set variables is affected. v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win. Users are advised to upgrade. Nginx has a underscores_in_headers configuration variable to discard these headers at the proxy level as a mitigation. Any users that are implicitly trusting the proxy defined headers for security should immediately cease doing so until upgraded to the fixed versions.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| puma | puma | 6.0.0 to before 6.4.3; before 5.6.9 | 6.4.3, 5.6.9 | Patch available | CNA |
| — | puma (RubyGems) | before 5.6.9 | 5.6.9 | Patch available | GHSA-9hf4-67fc-4vf4 |
| — | puma (RubyGems) | 6.0.0 to before 6.4.3 | 6.4.3 | Patch available | GHSA-9hf4-67fc-4vf4 |
- puma Vendorpuma Affected 6.0.0 to before 6.4.3; before 5.6.9 Fixed in 6.4.3, 5.6.9 Patch available CNA
- puma (RubyGems) Vendor— Affected before 5.6.9 Fixed in 5.6.9 Patch available GHSA-9hf4-67fc-4vf4
- puma (RubyGems) Vendor— Affected 6.0.0 to before 6.4.3 Fixed in 6.4.3 Patch available GHSA-9hf4-67fc-4vf4
Remediation
- Fix · CNA puma (puma) Fixed in 6.4.3, 5.6.9
- Fix · GHSA-9hf4-67fc-4vf4 puma (RubyGems) Fixed in 5.6.9 Advisory →
- Fix · GHSA-9hf4-67fc-4vf4 puma (RubyGems) Fixed in 6.4.3 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Out of support scope |
Not affected: 2 products
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2024-45614
- 2026-10-03 Alias added: GHSA-9hf4-67fc-4vf4
- 2026-10-23 EPSS moved to the 50th–90th percentile
References
Advisory 2
Other 6
- https://nginx.org/en/docs/http/ngx_http_core_module.html#underscores_in_headers
- https://github.com/puma/puma/commit/cac3fd18cf29ed43719ff5d52d9cfec215f0a043
- https://github.com/puma/puma/commit/f196b23be24712fb8fb16051cc124798cc84f70e
- https://github.com/puma/puma
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2024-45614.yml
- https://lists.debian.org/debian-lts-announce/2024/11/msg00004.html
More Puma vulnerabilities
- TI-2022-08603 HTTP Request Smuggling in puma CVSS 3.1CRITICAL 9.1
- TI-2023-21048 Inconsistent Interpretation of HTTP Requests in puma CVSS 3.1CRITICAL 9.8
- TI-2022-07686 Information Exposure when using Puma with Rails CVSS 3.1HIGH 8.0
- TI-2020-08950 HTTP Smuggling via Transfer-Encoding Header in Puma CVSS 3.1HIGH 7.5
- TI-2020-08951 HTTP Smuggling via Transfer-Encoding Header in Puma CVSS 3.1HIGH 7.5
- TI-2020-04303 HTTP Response Splitting in Puma CVSS 3.1HIGH 7.5
Sources
- CVE-2024-45614 · CVE Program
- CVE-2024-45614 · NVD
- FIRST EPSS
- GHSA-9hf4-67fc-4vf4 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-45614 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences