puma/puma Security Advisories | GitStock

high2026-06-09

CVE-2026-47737-Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

GHSA-2vqw-3mp8-cgmx

high2026-06-08

CVE-2026-47736-Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

GHSA-qpgp-93vx-g8v8

medium2024-09-20

CVE-2024-45614-Puma's header normalization allows for client to clobber proxy set headers

GHSA-9hf4-67fc-4vf4

medium2024-01-08

CVE-2024-21647-Puma HTTP Request/Response Smuggling vulnerability

GHSA-c2f4-cvqm-65w2

critical2023-08-18

CVE-2023-40175-Puma HTTP Request/Response Smuggling vulnerability

GHSA-68xg-gqqm-vgj8

critical2022-03-30

CVE-2022-24790-Puma vulnerable to HTTP Request Smuggling

GHSA-h99w-9q5r-gjq9

high2022-02-11

CVE-2022-23634-Puma used with Rails may lead to Information Exposure

GHSA-rmj8-8hhh-gv5h

low2021-10-12

CVE-2021-41136-Puma with proxy which forwards LF characters as line endings could allow HTTP request smuggling

GHSA-48w2-rm65-62xx

high2021-05-18

CVE-2021-29509-Puma's Keepalive Connections Causing Denial Of Service

GHSA-q28m-8xjw-8vr5

medium2020-05-22

CVE-2020-11077-HTTP Smuggling via Transfer-Encoding Header in Puma

GHSA-w64w-qqph-5gxm

high2020-05-22

CVE-2020-11076-HTTP Smuggling via Transfer-Encoding Header in Puma

GHSA-x7jg-6pwg-fx5h

medium2020-03-03

CVE-2020-5249-HTTP Response Splitting (Early Hints) in Puma

GHSA-33vf-4xgg-9r58

medium2020-02-28

CVE-2020-5247-HTTP Response Splitting in Puma

GHSA-84j7-475p-hp8v