PU
Product
puma
14
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 9Medium 3Low 1
Watch
Add puma to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-40175 | 9.8 | Aug 18 | Puma is a Ruby/Rack web server built for parallelism Affected: before 5.6.7; 6.0.0 before 6.3.1 |
| CVE-2026-47736 | 7.5 | Jul 14 | Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion Affected: >= 5.5.0, < 7.2.1; >= 8.0.0, < 8.0.2 |
| CVE-2026-47737 | 7.5 | Jul 14 | Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections Affected: >= 5.5.0, < 7.2.1; >= 8.0.0, < 8.0.2 |
| CVE-2024-21647 | 7.5 | Jan 8 | Puma is a web server for Ruby/Rack applications built for parallelism Affected: before 5.6.8; 6.0.0 before 6.4.2 |
| CVE-2022-24790 | 7.5 | Mar 30 | Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications Affected: before 4.3.12; 5.0.0 before 5.6.4 |
| CVE-2021-29509 | 7.5 | May 11 | Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications Affected: before 4.3.8; 5.0.0 before 5.3.1 |
| CVE-2020-11077 | 7.5 | May 22 | In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client Affected: 3.0.0 before 3.12.6; 4.0.0 before 4.3.5 |
| CVE-2020-11076 | 7.5 | May 22 | In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header Affected: 3.0.0 before 3.12.6; 4.0.0 before 4.3.5 |
| CVE-2020-5247 | 7.5 | Feb 28 | In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e Affected: through 3.12.3; 4.0.0 through 4.3.2 |
| CVE-2019-16770 | 7.5 | Dec 5 | In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack Affected: 3.0.0 before 3.12.2; 4.0.0 before 4.3.1 |
| CVE-2020-5249 | 6.5 | Mar 2 | In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the… Affected: through 3.12.3; 4.0.0 through 4.3.2 |
| CVE-2022-23634 | 5.9 | Feb 11 | Puma is a Ruby/Rack web server built for parallelism Affected: before 4.3.11; 5.0.0 before 5.6.2 |
| CVE-2024-45614 | 5.4 | Sep 19 | Puma is a Ruby/Rack web server built for parallelism Affected: before 5.6.9; 6.0.0 before 6.4.3 |
| CVE-2021-41136 | 3.7 | Oct 12 | Puma is a HTTP 1.1 server for Ruby/Rack applications Affected: through 4.3.8; 5.0.0 through 5.5.0 |
Showing 14