Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The vulnerability has been fixed in 5.6.4 and 4.3.12. Users are advised to upgrade as soon as possible. Workaround: when deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Mar 30, 2022 |
| Debian | — | Upgrade puma | Aug 29, 2022 | Mar 30, 2022 |
| Gentoo Linux | — | Upgrade www-servers/puma. | Aug 16, 2022 | Mar 30, 2022 |
| Suse | — | Upgrade ruby2.5-rubygem-puma-docUpgrade ruby2.5-rubygem-puma | Oct 26, 2022 | Mar 30, 2022 |
| Ubuntu | — | Upgrade puma (Ubuntu Pro) | Mar 8, 2024 | Mar 30, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub