Log in Start free

Vulnerability · Published Mar 30, 2022 · Assigned by GitHub_M

CVE-2022-24790HTTP Request Smuggling in puma

Critical 9.1

In plain English

A critical-severity security flaw in puma from puma. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)2.2%top 17.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The vulnerability has been fixed in 5.6.4 and 4.3.12. Users are advised to upgrade as soon as possible. Workaround: when deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12puma5.6.4-1DEBIAN-CVE-2022-24790
Debian:13puma5.6.4-1DEBIAN-CVE-2022-24790
Debian:14puma5.6.4-1DEBIAN-CVE-2022-24790
RubyGemspuma5.6.4GHSA-h99w-9q5r-gjq9
RubyGemspuma4.3.12GHSA-h99w-9q5r-gjq9

Affected products (as reported)

VendorProductVersions
puma puma < 4.3.12>= 5.0.0, < 5.6.4

Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References