CVE-2026-47737 | High | 7.5 | 2026-07-14 | Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_… |
CVE-2026-47736 | High | 7.5 | 2026-07-14 | Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes in… |
CVE-2024-45614 | Medium | 5.4 | 2024-09-19 | Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) b… |
CVE-2024-21647 | Medium | 5.9 | 2024-01-08 | Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer… |
CVE-2023-40175 | High | 7.3 | 2023-08-18 | Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encodi… |
CVE-2022-24790 | Critical | 9.1 | 2022-03-30 | Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate tha… |
CVE-2022-23634 | High | 8.0 | 2022-02-11 | Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to… |
CVE-2021-41136 | Low | 3.7 | 2021-10-12 | Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP header values which cont… |
CVE-2021-29509 | High | 7.5 | 2021-05-11 | Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connection… |
CVE-2020-11077 | Medium | 6.8 | 2020-05-22 | In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown clien… |
CVE-2020-11076 | High | 7.5 | 2020-05-22 | In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed… |
CVE-2020-5249 | Medium | 6.5 | 2020-03-02 | In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return… |
CVE-2020-5247 | Medium | 6.5 | 2020-02-28 | In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline charact… |
CVE-2019-16770 | Medium | 5.3 | 2019-12-05 | In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service atta… |
CVE-2017-8943 | Medium | 5.9 | 2017-05-15 | The PUMA PUMATRAC app 3.0.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain s… |