Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

15 records

Vendor: puma Clear all filters
TI-2024-14372 CVE-2024-21647 · GHSA-c2f4-cvqm-65w2

HTTP Request/Response Smuggling in puma

Priority LOW 35

Puma is a web server for Ruby/Rack applications built for parallelism.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00958 Published 2024-01-08 Partial fix · 5.6.8, 6.4.2 CWE-444
TI-2022-08603 CVE-2022-24790 · GHSA-h99w-9q5r-gjq9

HTTP Request Smuggling in puma

Priority MEDIUM 52

Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02191 Published 2022-03-30 Partial fix · 4.3.12, 5.6.4 CWE-444
TI-2022-07686 CVE-2022-23634 · GHSA-rmj8-8hhh-gv5h

Information Exposure when using Puma with Rails

Priority MEDIUM 41

Puma is a Ruby/Rack web server built for parallelism.

CVSS 3.1HIGH 8.0 Network No auth User interaction EPSS 0.02107 Published 2022-02-11 Partial fix · 5.6.2, 4.3.11 CWE-200
TI-2020-08951 CVE-2020-11077 · GHSA-w64w-qqph-5gxm

HTTP Smuggling via Transfer-Encoding Header in Puma

Priority LOW 38

In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02877 Published 2020-05-22 Partial fix · 3.12.6, 4.3.5 CWE-444
TI-2020-08950 CVE-2020-11076 · GHSA-x7jg-6pwg-fx5h

HTTP Smuggling via Transfer-Encoding Header in Puma

Priority MEDIUM 40

In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04088 Published 2020-05-22 Partial fix · 3.12.5, 4.3.4 CWE-444
TI-2020-04305 CVE-2020-5249 · GHSA-33vf-4xgg-9r58

HTTP Response Splitting (Early Hints) in Puma

Priority LOW 32

In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, suc…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.01571 Published 2020-03-02 Partial fix · 3.12.4, 4.3.3 CWE-113
TI-2020-04303 CVE-2020-5247 · GHSA-84j7-475p-hp8v

HTTP Response Splitting in Puma

Priority LOW 38

In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02549 Published 2020-02-28 Partial fix · 3.12.3, 4.3.2 +2 CWE-113
TI-2019-12551 CVE-2019-16770 · GHSA-7xx3-m584-x994

Potential DOS attack in Puma

Priority LOW 37

In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02014 Published 2019-12-05 Partial fix · 4.3.1, 3.12.2 CWE-770