Skip to content
OpenAdvisories
Medium DLA-3947-1 2 CVEs

puma - security update

Published Nov 6, 2024 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 puma 4.3.8-1+deb11u3

Vulnerabilities 2

  • Medium 5.9
    CVE-2024-21647

    HTTP Request/Response Smuggling in puma

    Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chun…

    puma puma puma puma Debian Ubuntu Wolfi RubyGems
  • Medium 5.4
    CVE-2024-45614 Public exploit

    Header normalization allows for client to clobber proxy set headers in Puma

    Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy se…

    puma puma puma puma Debian Ubuntu Wolfi RubyGems