Vulnerability index

Browse CVEs

12 matching

Cards Compact

Filters 1 Clear all

Keyword

Severity

Any Critical High Medium Low

Technology

Recency

Analysis

Fix

Sort

Exploited (KEV) only

Filters apply as you choose them.

Puma MEDIUM 5.4

CVE-2024-45614

Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwar…

Fix: 5.6.9 / 6.4.3+

Fix from $1,600 2024-09-19

Puma HIGH 7.5

CVE-2024-21647

Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked…

Fix: 5.6.8 / 6.4.2+

Fix from $1,950 2024-01-08

Puma CRITICAL 9.8

CVE-2023-40175

Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked trans…

Fix: 5.6.7 / 6.3.1+

Fix from $2,300 2023-08-18

Puma HIGH 7.5

CVE-2022-24790

Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly va…

Fix: 4.3.12 / 5.6.4+

Fix from $1,950 2022-03-30

Puma MEDIUM 5.9

CVE-2022-23634

Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails…

Fix: 4.3.11 / 5.2.6.2+

Fix from $1,600 2022-02-11

Puma HIGH 7.5

CVE-2021-29509

Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing …

Fix: 4.3.8 / 5.3.1+

Fix from $1,950 2021-05-11

Puma HIGH 7.5

CVE-2020-11076

In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has …

Fix: 3.12.6 / 4.3.5+

Fix from $1,950 2020-05-22

Puma HIGH 7.5

CVE-2020-11077

In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unk…

Fix: 3.12.6 / 4.3.5+

Fix from $1,950 2020-05-22

Puma MEDIUM 6.5

CVE-2020-5249

In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carria…

Fix: after 4.3.2

Fix from $1,600 2020-03-02

Puma HIGH 7.5

CVE-2020-5247

In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newli…

Fix: after 4.3.2

Fix from $1,950 2020-02-28

Puma HIGH 7.5

CVE-2019-16770

In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of se…

Fix: 3.12.2 / 4.3.1+

Fix from $1,950 2019-12-05

Pumatrac MEDIUM 5.9

CVE-2017-8943

The PUMA PUMATRAC app 3.0.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers an…

Mitigation only

Fix from $1,600 2017-05-15