Skip to content
OpenAdvisories
High DLA-3023-1 3 CVEs

puma - security update

Published May 26, 2022 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 puma 3.6.0-1+deb9u2

Vulnerabilities 3

  • High 8.0
    CVE-2022-23634

    Information Exposure when using Puma with Rails

    Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` …

    puma puma puma puma Debian Ubuntu RubyGems
  • Medium 6.5
    CVE-2020-5247

    HTTP Response Splitting in Puma

    In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. `CR`, `LF` or`/r`, `/n`) to end the header and inject malicious content, such as additiona…

    puma puma puma puma Debian RubyGems
  • Medium 5.3
    CVE-2019-16770

    Potential DOS attack in Puma

    In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional co…

    puma puma puma puma Debian RubyGems