High severity · published Jan 8, 2024
CVE-2024-21647
Puma is a web server for Ruby/Rack applications built for parallelism
7.5
CVSS
1%
EPSS
No
On KEV
Description
Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. This vulnerability has been fixed in versions 6.4.2 and 5.6.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PU
Puma · Puma
before 5.6.8; 6.0.0 before 6.4.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-21647
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-21647
Patch
https://github.com/puma/puma/commit/5fc43d73b6ff193325e657a24ed76dec79133e93
Vendor Advisory
https://github.com/puma/puma/security/advisories/GHSA-c2f4-cvqm-65w2
lists.debian.org
https://lists.debian.org/debian-lts-announce/2024/11/msg00004.html
More from Puma
9.8
CVE-2023-40175
Puma is a Ruby/Rack web server built for parallelism
7.5
CVE-2026-47736
Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion
7.5
CVE-2026-47737
Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections
7.5
CVE-2022-24790
Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications
7.5
CVE-2021-29509
Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications