PU
Product
puma
14
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 9Medium 3Low 1
Watch
Add puma to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-47736 | 7.5 | Jul 14 | Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion Affected: >= 5.5.0, < 7.2.1; >= 8.0.0, < 8.0.2 |
| CVE-2026-47737 | 7.5 | Jul 14 | Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections Affected: >= 5.5.0, < 7.2.1; >= 8.0.0, < 8.0.2 |
| CVE-2024-21647 | 7.5 | Jan 8 | Puma is a web server for Ruby/Rack applications built for parallelism Affected: before 5.6.8; 6.0.0 before 6.4.2 |
| CVE-2022-24790 | 7.5 | Mar 30 | Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications Affected: before 4.3.12; 5.0.0 before 5.6.4 |
| CVE-2021-29509 | 7.5 | May 11 | Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications Affected: before 4.3.8; 5.0.0 before 5.3.1 |
| CVE-2020-11077 | 7.5 | May 22 | In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client Affected: 3.0.0 before 3.12.6; 4.0.0 before 4.3.5 |
| CVE-2020-11076 | 7.5 | May 22 | In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header Affected: 3.0.0 before 3.12.6; 4.0.0 before 4.3.5 |
| CVE-2020-5247 | 7.5 | Feb 28 | In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e Affected: through 3.12.3; 4.0.0 through 4.3.2 |
| CVE-2019-16770 | 7.5 | Dec 5 | In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack Affected: 3.0.0 before 3.12.2; 4.0.0 before 4.3.1 |
Showing 9