Vulnerabilities > Puma
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-09-19 | CVE-2024-45614 | HTTP Request Smuggling vulnerability in Puma Puma is a Ruby/Rack web server built for parallelism. | 5.4 |
| 2024-01-08 | CVE-2024-21647 | HTTP Request Smuggling vulnerability in Puma Puma is a web server for Ruby/Rack applications built for parallelism. | 7.5 |
| 2023-08-18 | CVE-2023-40175 | HTTP Request Smuggling vulnerability in Puma Puma is a Ruby/Rack web server built for parallelism. | 9.8 |
| 2022-03-30 | CVE-2022-24790 | HTTP Request Smuggling vulnerability in multiple products Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. | 7.5 |
| 2022-02-11 | CVE-2022-23634 | Improper Resource Shutdown or Release vulnerability in multiple products Puma is a Ruby/Rack web server built for parallelism. | 5.9 |
| 2021-10-12 | CVE-2021-41136 | HTTP Request Smuggling vulnerability in multiple products Puma is a HTTP 1.1 server for Ruby/Rack applications. | 3.7 |
| 2021-05-11 | CVE-2021-29509 | Resource Exhaustion vulnerability in multiple products Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. | 7.5 |
| 2020-05-22 | CVE-2020-11077 | HTTP Request Smuggling vulnerability in multiple products In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. | 7.5 |
| 2020-05-22 | CVE-2020-11076 | HTTP Request Smuggling vulnerability in multiple products In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. | 7.5 |
| 2020-03-02 | CVE-2020-5249 | Injection vulnerability in Puma In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, such as additional headers or an entirely new response body. | 6.5 |