puma (RubyGems)
Advisories
28
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 8.0.2 or later clears every advisory below that has a fix.
Upgrade commands
bundler
bundle update puma # Gemfile: gem "puma", ">= 8.0.2"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-2vqw-3mp8-cgmx Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections |
High EPSS 0.18% |
>= 5.5.0, < 7.2.1 | 7.2.1 |
| GHSA-2vqw-3mp8-cgmx Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections |
High EPSS 0.18% |
>= 8.0.0, < 8.0.2 | 8.0.2 |
| GHSA-qpgp-93vx-g8v8 Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion |
High EPSS 0.35% |
>= 5.5.0, < 7.2.1 | 7.2.1 |
| GHSA-qpgp-93vx-g8v8 Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion |
High EPSS 0.35% |
>= 8.0.0, < 8.0.2 | 8.0.2 |
| GHSA-9hf4-67fc-4vf4 Puma's header normalization allows for client to clobber proxy set headers |
Medium EPSS 0.64% |
>= 6.0.0, < 6.4.3 | 6.4.3 |
| GHSA-9hf4-67fc-4vf4 Puma's header normalization allows for client to clobber proxy set headers |
Medium EPSS 0.64% |
< 5.6.9 | 5.6.9 |
| GHSA-c2f4-cvqm-65w2 Puma HTTP Request/Response Smuggling vulnerability |
High EPSS 0.96% |
< 5.6.8 | 5.6.8 |
| GHSA-c2f4-cvqm-65w2 Puma HTTP Request/Response Smuggling vulnerability |
High EPSS 0.96% |
>= 6.0.0, < 6.4.2 | 6.4.2 |
| GHSA-68xg-gqqm-vgj8 Puma HTTP Request/Response Smuggling vulnerability |
Critical EPSS 0.85% |
< 5.6.7 | 5.6.7 |
| GHSA-68xg-gqqm-vgj8 Puma HTTP Request/Response Smuggling vulnerability |
Critical EPSS 0.85% |
>= 6.0.0, < 6.3.1 | 6.3.1 |
| GHSA-h99w-9q5r-gjq9 Puma vulnerable to HTTP Request Smuggling |
Critical EPSS 2.19% |
>= 5.0.0, < 5.6.4 | 5.6.4 |
| GHSA-h99w-9q5r-gjq9 Puma vulnerable to HTTP Request Smuggling |
Critical EPSS 2.19% |
< 4.3.12 | 4.3.12 |
| GHSA-rmj8-8hhh-gv5h Puma used with Rails may lead to Information Exposure |
High EPSS 2.11% |
< 4.3.11 | 4.3.11 |
| GHSA-rmj8-8hhh-gv5h Puma used with Rails may lead to Information Exposure |
High EPSS 2.11% |
>= 5.0.0, < 5.6.2 | 5.6.2 |
| GHSA-48w2-rm65-62xx Puma with proxy which forwards LF characters as line endings could allow HTTP request smuggling |
Low EPSS 1.20% |
>= 5.0.0, < 5.5.1 | 5.5.1 |
| GHSA-48w2-rm65-62xx Puma with proxy which forwards LF characters as line endings could allow HTTP request smuggling |
Low EPSS 1.20% |
< 4.3.9 | 4.3.9 |
| GHSA-q28m-8xjw-8vr5 Puma's Keepalive Connections Causing Denial Of Service |
High EPSS 1.60% |
>= 5.0.0, < 5.3.1 | 5.3.1 |
| GHSA-q28m-8xjw-8vr5 Puma's Keepalive Connections Causing Denial Of Service |
High EPSS 1.60% |
< 4.3.8 | 4.3.8 |
| GHSA-w64w-qqph-5gxm HTTP Smuggling via Transfer-Encoding Header in Puma |
Medium EPSS 2.88% |
>= 4.0.0, < 4.3.5 | 4.3.5 |
| GHSA-w64w-qqph-5gxm HTTP Smuggling via Transfer-Encoding Header in Puma |
Medium EPSS 2.88% |
< 3.12.6 | 3.12.6 |
| GHSA-x7jg-6pwg-fx5h HTTP Smuggling via Transfer-Encoding Header in Puma |
High EPSS 4.09% |
>= 4.0.0, < 4.3.4 | 4.3.4 |
| GHSA-x7jg-6pwg-fx5h HTTP Smuggling via Transfer-Encoding Header in Puma |
High EPSS 4.09% |
< 3.12.5 | 3.12.5 |
| GHSA-33vf-4xgg-9r58 HTTP Response Splitting (Early Hints) in Puma |
Medium EPSS 1.57% |
>= 4.0.0, < 4.3.3 | 4.3.3 |
| GHSA-33vf-4xgg-9r58 HTTP Response Splitting (Early Hints) in Puma |
Medium EPSS 1.57% |
< 3.12.4 | 3.12.4 |
| GHSA-84j7-475p-hp8v HTTP Response Splitting in Puma |
Medium EPSS 2.55% |
>= 4.0.0, < 4.3.3 | 4.3.3 |
| GHSA-84j7-475p-hp8v HTTP Response Splitting in Puma |
Medium EPSS 2.55% |
< 3.12.4 | 3.12.4 |
| GHSA-7xx3-m584-x994 A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack |
Medium EPSS 2.01% |
>= 4.0.0, < 4.3.1 | 4.3.1 |
| GHSA-7xx3-m584-x994 A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack |
Medium EPSS 2.01% |
< 3.12.2 | 3.12.2 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor