Skip to content
OpenAdvisories
Critical DSA-5146-1 3 CVEs

puma - security update

Published May 24, 2022 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 puma 4.3.8-1+deb11u2

Vulnerabilities 3

  • Critical 9.1
    CVE-2022-24790

    HTTP Request Smuggling in puma

    Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree o…

    puma puma puma puma Debian Ubuntu RubyGems
  • High 8.0
    CVE-2022-23634

    Information Exposure when using Puma with Rails

    Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` …

    puma puma puma puma Debian Ubuntu RubyGems
  • Low 3.7
    CVE-2021-41136

    Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma

    Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a…

    puma puma puma puma Debian RubyGems