Description
Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| puma | puma | >= 5.0.0, < 5.6.2, < 4.3.11 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | puma | 5.6.4-1 | — |
| Debian 13 | puma | 5.6.4-1 | — |
| Debian 12 | puma | 5.6.4-1 | — |
| Debian 11 | puma | 4.3.8-1+deb11u2 | DSA-5146-1 |
| Debian 10 | puma | 3.12.0-2+deb10u3 | DLA-3083-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | puma | 3.6.0-1+deb9u2 | DLA-3023-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | puma | 5.5.2-2ubuntu2+esm1 | USN-6682-1 |
| Ubuntu Pro 20.04 LTS | puma | 3.12.4-1ubuntu2+esm1 | USN-6682-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman | 3.1.1.21-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite Utils 6 | satellite | 6.11.0-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | foreman | 3.1.1.21-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | libsolv | 0.7.22-1.el7pc | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | python-django +1 | 3.2.13-1.el8pc | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | python-lxml | 4.7.1-1.el8pc | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | python-sqlparse | 0.4.2-2.el8pc | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | satellite | 6.11.0-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | candlepin | 4.1.13-1.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | foreman | 3.1.1.21-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | libsolv | 0.7.22-1.el7pc | RHSA-2022:5498 |
| Red Hat Satellite 6 | python-django +1 | 3.2.13-1.el8pc | RHSA-2022:5498 |
| Red Hat Satellite 6 | python-lxml | 4.7.1-1.el8pc | RHSA-2022:5498 |
| Red Hat Satellite 6 | python-sqlparse | 0.4.2-2.el8pc | RHSA-2022:5498 |
| Red Hat Satellite 6 | rubygem-actionpack | 6.0.4.7-1.el8sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | rubygem-puma | 5.6.2-1.el8sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | rubygem-sidekiq | 5.2.10-1.el8sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | satellite | 6.11.0-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | tfm-rubygem-actionpack | 6.0.4.7-1.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | tfm-rubygem-puma | 5.6.2-1.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | tfm-rubygem-sidekiq | 5.2.10-1.el7sat | RHSA-2022:5498 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | libdb | 5.3.28-42.el8_4 | RLSA-2022:5498 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | rubygem-puma | 4.3.11-150000.3.6.2 | SUSE-SU-2022:1515-1 |
| SLES 15 SP2 | rubygem-puma | 4.3.11-150000.3.6.2 | SUSE-SU-2022:1515-1 |
| SLES 15 SP1 | rubygem-puma | 4.3.11-150000.3.6.2 | SUSE-SU-2022:1515-1 |
| SLES 15 | rubygem-puma | 4.3.11-150000.3.6.2 | SUSE-SU-2022:1515-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ruby3.2-rubygem-puma | 6.0.0-2.1 | openSUSE-SU-2024:12900-1 |
| openSUSE Tumbleweed | rubygem-puma | 5.6.2-1.1 | openSUSE-SU-2026:10357-1, openSUSE-SU-2025:15123-1, openSUSE-SU-2024:13720-1 |
| openSUSE Leap 15.4 | rubygem-puma | 4.3.11-150000.3.6.2 | SUSE-SU-2022:1515-1 |
| openSUSE Leap 15.3 | rubygem-puma | 4.3.11-150000.3.6.2 | SUSE-SU-2022:1515-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | puma | >= 5.0.0, < 5.6.2 | 5.6.2 | GHSA-rmj8-8hhh-gv5h |
| RubyGems | puma | < 4.3.11 | 4.3.11 | GHSA-rmj8-8hhh-gv5h |
Advisories 12
- RHSA-2022:5498 Red Hat Security Advisory: Satellite 6.11 Release Red Hat Security Advisories (RHSA) · Oct 13, 2026
- USN-6682-1 puma vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- openSUSE-SU-2026:10357-1 ruby4.0-rubygem-puma-6.4.3-1.5 on GA media SUSE / openSUSE Security Updates · Mar 14, 2026
- DSA-5146-1 puma - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3083-1 puma - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3023-1 puma - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2022:5498 Moderate: Satellite 6.11 Release Rocky Linux Security Advisories · Feb 5, 2026
- openSUSE-SU-2025:15123-1 ruby3.4-rubygem-puma-6.4.3-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11847-1 ruby3.1-rubygem-puma-5.6.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12900-1 ruby3.2-rubygem-puma-6.0.0-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13720-1 ruby3.3-rubygem-puma-6.4.2-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-SU-2022:1515-1 Security update for rubygem-puma SUSE / openSUSE Security Updates · May 2, 2025
References
- https://github.com/puma/puma/security/advisories/GHSA-rmj8-8hhh-gv5h
- https://github.com/puma/puma/commit/b70f451fe8abc0cff192c065d549778452e155bb
- https://github.com/advisories/GHSA-rmj8-8hhh-gv5h
- https://github.com/advisories/GHSA-wh98-p28r-vrc9
- https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ?utm_medium=email&utm_source=footer&pli=1
- DSA-5146 vendor-advisory
- [debian-lts-announce] 20220525 [SECURITY] [DLA 3023-1] puma security update mailing-list
- GLSA-202208-28 vendor-advisory
- [debian-lts-announce] 20220827 [SECURITY] [DLA 3083-1] puma security update mailing-list
- FEDORA-2022-de968d1b6c vendor-advisory
- FEDORA-2022-52d0032596 vendor-advisory
- FEDORA-2022-7c8b29195f vendor-advisory