Puma vulnerabilities
We track 5 vulnerabilities in Puma products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on July 14, 2026.
Latest Puma vulnerabilities
- 7.5 High severity
puma: Authentication Bypass by Spoofing
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY
- 7.5 High severity
puma: Uncontrolled Resource Consumption
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowin
- 7.5 High severity
puma: Inconsistent Interpretation of HTTP Requests
Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk
- 9.8 Critical severity
puma: Inconsistent Interpretation of HTTP Requests
Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severi
- 7.5 High severity
puma: Inconsistent Interpretation of HTTP Requests
Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on