Description
Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The vulnerability has been fixed in 5.6.4 and 4.3.12. Users are advised to upgrade as soon as possible. Workaround: when deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| puma | puma | < 4.3.12, >= 5.0.0, < 5.6.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | puma | 5.6.4-1 | — |
| Debian 13 | puma | 5.6.4-1 | — |
| Debian 12 | puma | 5.6.4-1 | — |
| Debian 11 | puma | 4.3.8-1+deb11u2 | DSA-5146-1 |
| Debian 10 | puma | 3.12.0-2+deb10u3 | DLA-3083-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | puma | 5.5.2-2ubuntu2+esm1 | USN-6682-1 |
| Ubuntu Pro 20.04 LTS | puma | 3.12.4-1ubuntu2+esm1 | USN-6682-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite 6 | tfm-rubygem-puma | 4.3.12-1.el7sat | RHSA-2022:8532 |
| Red Hat Gluster Storage 3 | grafana | 5.2.4-6.el7rhgs | RHSA-2023:1486 |
| Red Hat Gluster Storage 3 | rubygem-puma +1 | 4.3.12-1.el7rhgs | RHSA-2023:1486 |
| Red Hat Gluster Storage 3 | rubygem-rack +1 | 2.2.4-1.el7rhgs | RHSA-2023:1486 |
| Red Hat Gluster Storage 3 | rubygem-tzinfo +1 | 1.2.10-1.el7rhgs | RHSA-2023:1486 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | rubygem-puma | 4.3.12-150000.3.9.1 | SUSE-SU-2022:3571-1 |
| SLES 15 SP3 | rubygem-puma | 4.3.12-150000.3.9.1 | SUSE-SU-2022:3571-1 |
| SLES 15 SP2 | rubygem-puma | 4.3.12-150000.3.9.1 | SUSE-SU-2022:3571-1 |
| SLES 15 SP1 | rubygem-puma | 4.3.12-150000.3.9.1 | SUSE-SU-2022:3571-1 |
| SLES 15 | rubygem-puma | 4.3.12-150000.3.9.1 | SUSE-SU-2022:3571-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud Crowbar 9 | grafana | 6.7.4-3.29.1 | SUSE-SU-2022:3339-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-heat-templates | 0.0.0+git.1654529662.75fa04a7-3.15.1 | SUSE-SU-2022:3339-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-horizon-plugin-gbp-ui | 14.0.1~dev4-3.12.1 | SUSE-SU-2022:3339-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-neutron-gbp | 14.0.1~dev46-3.34.1 | SUSE-SU-2022:3339-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-nova | 18.3.1~dev92-3.43.1 | SUSE-SU-2022:3339-1 |
| SUSE OpenStack Cloud Crowbar 9 | python-Django1 | 1.11.29-3.40.1 | SUSE-SU-2022:3339-1 |
| SUSE OpenStack Cloud Crowbar 9 | rabbitmq-server | 3.6.16-4.3.1 | SUSE-SU-2022:3339-1 |
| SUSE OpenStack Cloud Crowbar 9 | rubygem-puma | 2.16.0-4.18.1 | SUSE-SU-2022:3339-1 |
| SUSE OpenStack Cloud Crowbar 8 | grafana | 6.7.4-4.23.1 | SUSE-SU-2022:3338-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-heat-templates | 0.0.0+git.1654529662.75fa04a-3.27.1 | SUSE-SU-2022:3338-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-murano +1 | 4.0.2~dev3-3.12.1 | SUSE-SU-2022:3338-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-Django | 1.11.29-3.42.1 | SUSE-SU-2022:3338-1 |
| SUSE OpenStack Cloud Crowbar 8 | rabbitmq-server | 3.6.16-3.13.1 | SUSE-SU-2022:3338-1 |
| SUSE OpenStack Cloud Crowbar 8 | rubygem-puma | 2.16.0-3.18.1 | SUSE-SU-2022:3338-1 |
| SUSE OpenStack Cloud 9 | ardana-ansible | 9.0+git.1660748476.c118d23-3.32.1 | SUSE-SU-2022:3339-1 |
| SUSE OpenStack Cloud 9 | ardana-cobbler | 9.0+git.1660747489.119efcd-3.19.1 | SUSE-SU-2022:3339-1 |
| SUSE OpenStack Cloud 9 | ardana-tempest | 9.0+git.1651855288.a2341ad-3.22.1 | SUSE-SU-2022:3339-1 |
| SUSE OpenStack Cloud 9 | grafana | 6.7.4-3.29.1 | SUSE-SU-2022:3339-1 |
| SUSE OpenStack Cloud 9 | openstack-heat-templates | 0.0.0+git.1654529662.75fa04a7-3.15.1 | SUSE-SU-2022:3339-1 |
| SUSE OpenStack Cloud 9 | openstack-horizon-plugin-gbp-ui | 14.0.1~dev4-3.12.1 | SUSE-SU-2022:3339-1 |
| SUSE OpenStack Cloud 9 | openstack-neutron-gbp | 14.0.1~dev46-3.34.1 | SUSE-SU-2022:3339-1 |
| SUSE OpenStack Cloud 9 | openstack-nova | 18.3.1~dev92-3.43.1 | SUSE-SU-2022:3339-1 |
| SUSE OpenStack Cloud 9 | python-Django1 | 1.11.29-3.40.1 | SUSE-SU-2022:3339-1 |
| SUSE OpenStack Cloud 9 | rabbitmq-server | 3.6.16-4.3.1 | SUSE-SU-2022:3339-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-heat | 11.0.4~dev4-3.37.1 | SUSE-SU-2022:3339-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-horizon | 14.1.1~dev11-4.41.1 | SUSE-SU-2022:3339-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-neutron | 13.0.8~dev206-6.41.1 | SUSE-SU-2022:3339-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-nova | 18.3.1~dev92-3.41.1 | SUSE-SU-2022:3339-1 |
| SUSE OpenStack Cloud 8 | ardana-ansible | 8.0+git.1660773729.3789a6d-3.85.1 | SUSE-SU-2022:3338-1 |
| SUSE OpenStack Cloud 8 | ardana-cobbler | 8.0+git.1660773402.d845a45-3.47.1 | SUSE-SU-2022:3338-1 |
| SUSE OpenStack Cloud 8 | grafana | 6.7.4-4.23.1 | SUSE-SU-2022:3338-1 |
| SUSE OpenStack Cloud 8 | openstack-heat-templates | 0.0.0+git.1654529662.75fa04a-3.27.1 | SUSE-SU-2022:3338-1 |
| SUSE OpenStack Cloud 8 | openstack-murano +1 | 4.0.2~dev3-3.12.1 | SUSE-SU-2022:3338-1 |
| SUSE OpenStack Cloud 8 | python-Django | 1.11.29-3.42.1 | SUSE-SU-2022:3338-1 |
| SUSE OpenStack Cloud 8 | rabbitmq-server | 3.6.16-3.13.1 | SUSE-SU-2022:3338-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-heat | 9.0.8~dev22-12.45.1 | SUSE-SU-2022:3338-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-horizon | 12.0.5~dev6-14.48.1 | SUSE-SU-2022:3338-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-murano | 4.0.2~dev3-12.38.1 | SUSE-SU-2022:3338-1 |
| SUSE HPE Helion OpenStack 8 | ardana-ansible | 8.0+git.1660773729.3789a6d-3.85.1 | SUSE-SU-2022:3338-1 |
| SUSE HPE Helion OpenStack 8 | ardana-cobbler | 8.0+git.1660773402.d845a45-3.47.1 | SUSE-SU-2022:3338-1 |
| SUSE HPE Helion OpenStack 8 | grafana | 6.7.4-4.23.1 | SUSE-SU-2022:3338-1 |
| SUSE HPE Helion OpenStack 8 | openstack-heat-templates | 0.0.0+git.1654529662.75fa04a-3.27.1 | SUSE-SU-2022:3338-1 |
| SUSE HPE Helion OpenStack 8 | openstack-murano +1 | 4.0.2~dev3-3.12.1 | SUSE-SU-2022:3338-1 |
| SUSE HPE Helion OpenStack 8 | python-Django | 1.11.29-3.42.1 | SUSE-SU-2022:3338-1 |
| SUSE HPE Helion OpenStack 8 | rabbitmq-server | 3.6.16-3.13.1 | SUSE-SU-2022:3338-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-heat | 9.0.8~dev22-12.45.1 | SUSE-SU-2022:3338-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-horizon-hpe | 12.0.5~dev6-14.48.1 | SUSE-SU-2022:3338-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-murano | 4.0.2~dev3-12.38.1 | SUSE-SU-2022:3338-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ruby3.2-rubygem-puma-5 | 5.6.5-1.7 | openSUSE-SU-2024:13166-1 |
| openSUSE Tumbleweed | rubygem-puma-4 | 4.3.12-1.1 | openSUSE-SU-2024:12032-1 |
| openSUSE Tumbleweed | rubygem-puma-5 | 5.6.5-1.1 | openSUSE-SU-2024:13721-1, openSUSE-SU-2024:12592-1 |
| openSUSE Leap 15.4 | rubygem-puma | 4.3.12-150000.3.9.1 | SUSE-SU-2022:3571-1 |
| openSUSE Leap 15.3 | rubygem-puma | 4.3.12-150000.3.9.1 | SUSE-SU-2022:3571-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | puma | >= 5.0.0, < 5.6.4 | 5.6.4 | GHSA-h99w-9q5r-gjq9 |
| RubyGems | puma | < 4.3.12 | 4.3.12 | GHSA-h99w-9q5r-gjq9 |
Advisories 13
- RHSA-2023:1486 Red Hat Security Advisory: Red Hat Gluster Storage web-admin-build security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:8532 Red Hat Security Advisory: Satellite 6.9.10 Async Security Update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-6682-1 puma vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-5146-1 puma - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3083-1 puma - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2022:3571-1 Security update for rubygem-puma SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3338-1 Security update for ardana-ansible, ardana-cobbler, grafana, openstack-heat-templates, openstack-murano, python-Django, rabbitmq-server, rubygem-puma SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13166-1 ruby3.2-rubygem-puma-5-5.6.5-1.7 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3339-1 Security update for ardana-ansible, ardana-cobbler, ardana-tempest, grafana, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-neutron-gbp, openstack-nova, python-Django1, rabbitmq-server, rubygem-puma SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12032-1 ruby3.1-rubygem-puma-4-4.3.12-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13721-1 ruby3.3-rubygem-puma-5-5.6.8-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12592-1 ruby3.1-rubygem-puma-5-5.6.5-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-2109 Red Hat Satellite: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Mar 27, 2023
References
- https://github.com/puma/puma/security/advisories/GHSA-h99w-9q5r-gjq9
- https://github.com/puma/puma/commit/5bb7d202e24dec00a898dca4aa11db391d7787a5
- DSA-5146 vendor-advisory
- GLSA-202208-28 vendor-advisory
- [debian-lts-announce] 20220827 [SECURITY] [DLA 3083-1] puma security update mailing-list
- FEDORA-2022-de968d1b6c vendor-advisory
- FEDORA-2022-52d0032596 vendor-advisory
- FEDORA-2022-7c8b29195f vendor-advisory