- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 14 · 1 critical, 6 high, 6 medium, 1 low
- Registry
- RubyGems
Advisories 14
- CVE-2026-47736High 7.5
Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion
Affected: from 8.0.0, fixed in 8.0.2; from 5.5.0, fixed in 7.2.1.
- CVE-2026-47737High 7.5
Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections
Affected: from 8.0.0, fixed in 8.0.2; from 5.5.0, fixed in 7.2.1.
- CVE-2024-45614Medium 5.4
Header normalization allows for client to clobber proxy set headers in Puma
Affected: fixed in 5.6.9; from 6.0.0, fixed in 6.4.3.
- CVE-2024-21647Medium 5.9
HTTP Request/Response Smuggling in puma
Affected: from 6.0.0, fixed in 6.4.2; fixed in 5.6.8.
- CVE-2023-40175High 7.3
Inconsistent Interpretation of HTTP Requests in puma
Affected: fixed in 5.6.7; from 6.0.0, fixed in 6.3.1.
- CVE-2022-24790Critical 9.1
HTTP Request Smuggling in puma
Affected: from 5.0.0, fixed in 5.6.4; fixed in 4.3.12.
- CVE-2022-23634High 8.0
Information Exposure when using Puma with Rails
Affected: from 5.0.0, fixed in 5.6.2; fixed in 4.3.11.
- CVE-2021-41136Low 3.7
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma
Affected: from 5.0.0, fixed in 5.5.1; fixed in 4.3.9.
- CVE-2021-29509High 7.5
Keepalive Connections Causing Denial Of Service in puma
Affected: fixed in 4.3.8; from 5.0.0, fixed in 5.3.1.
- CVE-2020-11077Medium 6.8
HTTP Smuggling via Transfer-Encoding Header in Puma
Affected: fixed in 3.12.6; from 4.0.0, fixed in 4.3.5.
- CVE-2020-11076High 7.5
HTTP Smuggling via Transfer-Encoding Header in Puma
Affected: fixed in 3.12.5; from 4.0.0, fixed in 4.3.4.
- CVE-2020-5249Medium 6.5
HTTP Response Splitting (Early Hints) in Puma
Affected: fixed in 3.12.4; from 4.0.0, fixed in 4.3.3.
- CVE-2020-5247Medium 6.5
HTTP Response Splitting in Puma
Affected: fixed in 3.12.4; from 4.0.0, fixed in 4.3.3.
- CVE-2019-16770Medium 5.3
Potential DOS attack in Puma
Affected: fixed in 3.12.2; from 4.0.0, fixed in 4.3.1.