Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

Version	Supported
Latest release in 7.x	✅
Latest release in 6.x	✅
All other releases	❌

Reporting a Vulnerability

Report on Github or contact Evan Phoenix.

Header normalization allows for client to clobber proxy set headers
GHSA-9hf4-67fc-4vf4 published Sep 19, 2024 by nateberkopec

Moderate
Invalid parsing of chunked encoding in HTTP/1.1 allows DoS attacks
GHSA-c2f4-cvqm-65w2 published Jan 8, 2024 by nateberkopec

Moderate
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in puma
GHSA-68xg-gqqm-vgj8 published Aug 18, 2023 by nateberkopec

Moderate
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma
GHSA-h99w-9q5r-gjq9 published Mar 30, 2022 by nateberkopec

Moderate
Information Exposure with Puma and Rails
GHSA-rmj8-8hhh-gv5h published Feb 11, 2022 by nateberkopec

High
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma
GHSA-48w2-rm65-62xx published Oct 12, 2021 by nateberkopec

Low
Keepalive Connections Causing Denial Of Service in puma
GHSA-q28m-8xjw-8vr5 published May 11, 2021 by nateberkopec

High
HTTP Smuggling via Transfer-Encoding Header
GHSA-w64w-qqph-5gxm published May 21, 2020 by nateberkopec

Moderate
HTTP Smuggling via Transfer-Encoding Header
GHSA-x7jg-6pwg-fx5h published May 21, 2020 by nateberkopec

Moderate
HTTP Response Splitting (Early Hints)
GHSA-33vf-4xgg-9r58 published Feb 28, 2020 by nateberkopec

Moderate

Learn more about advisories related to puma/puma in the GitHub Advisory Database