{"id":"CVE-2022-24790","published":"2022-03-30T21:50:09Z","modified":"2025-04-23T18:43:11Z","title":"HTTP Request Smuggling in puma","vendor":"puma","product":"puma","tier":"tail","description":{"text":"Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The vulnerability has been fixed in 5.6.4 and 4.3.12. Users are advised to upgrade as soon as possible. Workaround: when deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02191,"percentile":0.82447,"provenance":"source"},"cwes":[{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests"}],"references":[{"url":"https://github.com/puma/puma/security/advisories/GHSA-h99w-9q5r-gjq9","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/puma/puma/commit/5bb7d202e24dec00a898dca4aa11db391d7787a5","tags":["x_refsource_MISC"]},{"url":"https://www.debian.org/security/2022/dsa-5146","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://security.gentoo.org/glsa/202208-28","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/08/msg00015.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TUBFJ44NCKJ34LECZRAP4N5VL6USJSIB/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7NESIBFCNSR3XH7LXDPKVMSUBNUB43G/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6YWGIIKL7KKTS3ZOAYMYPC7D6WQ5OA5/","tags":["vendor-advisory","x_refsource_FEDORA"]}],"priority":{"score":22.9,"factors":[{"name":"EPSS percentile","points":16.49},{"name":"CVSS severity","points":6.37}]},"vendorSlug":"puma","affectedVersions":[{"vendor":"puma","product":"puma","versions":["< 4.3.12",">= 5.0.0, <  5.6.4"]}],"affected":[{"ecosystem":"RubyGems","package":"puma","vulnerableRanges":[">=5.0.0, <5.6.4","<4.3.12"],"patched":["5.6.4","4.3.12"],"from":["GHSA-h99w-9q5r-gjq9"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-1439","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2021-29509","published":"2021-05-11","fixed":"5.3.1","kev":false},{"cve":"CVE-2021-41136","published":"2021-10-12","fixed":"5.5.1","kev":false},{"cve":"CVE-2022-23634","published":"2022-02-11","fixed":"5.6.2","kev":false,"link":{"from":"CVE-2022-23634","to":"CVE-2022-24790","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:puma","fromFixed":"5.6.2","toFixed":"5.6.4","daysApart":47},{"kind":"version-step","provenance":"source","package":"RubyGems:puma","fromFixed":"4.3.11","toFixed":"4.3.12","daysApart":47}]}},{"cve":"CVE-2022-24790","published":"2022-03-30","fixed":"5.6.4","kev":false},{"cve":"CVE-2023-40175","published":"2023-08-18","fixed":"6.3.1","kev":false,"link":{"from":"CVE-2022-24790","to":"CVE-2023-40175","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:puma","fromFixed":"5.6.4","toFixed":"5.6.7","daysApart":506}]}},{"cve":"CVE-2024-21647","published":"2024-01-08","fixed":"6.4.2","kev":false},{"cve":"CVE-2024-45614","published":"2024-09-19","fixed":"6.4.3","kev":false}],"package":"RubyGems:puma"}}