HIGH7.5RubyGems
GHSA-2vqw-3mp8-cgmx· CVE-2026-47737Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections
Modified: 9/10/2026
package
RubyGems/puma
pkg:rubygems/puma
MEDIUM6.5RubyGems
GHSA-33vf-4xgg-9r58· CVE-2020-5249HTTP Response Splitting (Early Hints) in Puma
Modified: 2/4/2026
LOW3.7RubyGems
GHSA-48w2-rm65-62xx· CVE-2021-41136Puma with proxy which forwards LF characters as line endings could allow HTTP request smuggling
Modified: 7/8/2026
CRITICAL9.8RubyGems
GHSA-68xg-gqqm-vgj8· CVE-2023-40175Puma HTTP Request/Response Smuggling vulnerability
Modified: 9/10/2026
MEDIUM5.3RubyGems
GHSA-7xx3-m584-x994· CVE-2019-16770A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack
Modified: 7/8/2026
MEDIUM6.5RubyGems
GHSA-84j7-475p-hp8v· BIT-ruby-2020-5247, BIT-ruby-min-2020-5247HTTP Response Splitting in Puma
Modified: 7/8/2026
MEDIUM5.4RubyGems
GHSA-9hf4-67fc-4vf4· CVE-2024-45614Puma's header normalization allows for client to clobber proxy set headers
Modified: 9/10/2026
MEDIUM5.9RubyGems
GHSA-c2f4-cvqm-65w2· CVE-2024-21647Puma HTTP Request/Response Smuggling vulnerability
Modified: 9/10/2026
CRITICAL9.1RubyGems
GHSA-h99w-9q5r-gjq9· CVE-2022-24790Puma vulnerable to HTTP Request Smuggling
Modified: 2/16/2024
HIGH7.5RubyGems
GHSA-q28m-8xjw-8vr5· CVE-2021-29509Puma's Keepalive Connections Causing Denial Of Service
Modified: 7/8/2026
HIGH7.5RubyGems
GHSA-qpgp-93vx-g8v8· CVE-2026-47736Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion
Modified: 9/10/2026
HIGH8.0RubyGems
GHSA-rmj8-8hhh-gv5h· CVE-2022-23634Puma used with Rails may lead to Information Exposure
Modified: 2/4/2026
MEDIUM6.8RubyGems
GHSA-w64w-qqph-5gxm· CVE-2020-11077HTTP Smuggling via Transfer-Encoding Header in Puma
Modified: 9/10/2026
HIGH7.5RubyGems
GHSA-x7jg-6pwg-fx5h· CVE-2020-11076HTTP Smuggling via Transfer-Encoding Header in Puma
Modified: 9/10/2026