CVE catalog

CVE-2022-24790

puma: CVE-2022-24790

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.19% · Oct 25, 2026

Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The vulnerability has been fixed in 5.6.4 and 4.3.12. Users are advised to upgrade as soon as possible. Workaround: when deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpumasid8.0.2-3fixed
Debianpumaforky8.0.2-3fixed
Debianpumatrixie6.6.0-4fixed
Debianpumabookworm5.6.5-3+deb12u1fixed
Debianpumabookworm-security5.6.5-3+deb12u2fixed
Suserubygem-pumalinux enterprise high availability extension 154.3.12-150000.3.9.1fixed
Suserubygem-pumalinux enterprise high availability extension 15 sp14.3.12-150000.3.9.1fixed
Suserubygem-pumalinux enterprise high availability extension 15 sp24.3.12-150000.3.9.1fixed
Suserubygem-pumalinux enterprise high availability extension 15 sp34.3.12-150000.3.9.1fixed
Suserubygem-pumalinux enterprise high availability extension 15 sp44.3.12-150000.3.9.1fixed
Opensuserubygem-pumaleap 15.34.3.12-150000.3.9.1fixed
Opensuserubygem-pumaleap 15.44.3.12-150000.3.9.1fixed
Ubuntupumapro4.3.6-1ubuntu4vulnerable
Ubuntupumapro5.5.2-2ubuntu2vulnerable
Ubuntupumapro5.5.2-2ubuntu2+esm1fixed
Opensuserubygem-puma-4tumbleweed4.3.12-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpumasourcesid5.6.4-1not yet assignedNot reported[1008723]
Debianpumasourceforky5.6.4-1not yet assignedNot reported[1008723]
Debianpumasourcetrixie5.6.4-1not yet assignedNot reported[1008723]
Debianpumasourcebookworm5.6.4-1not yet assignedNot reported[1008723]
Suserubygem-pumarpmlinux enterprise high availability extension 154.3.12-150000.3.9.1Not reportedSUSE-SU-2022:3571-1Not reported
Suserubygem-pumarpmlinux enterprise high availability extension 15 sp14.3.12-150000.3.9.1Not reportedSUSE-SU-2022:3571-1Not reported
Suserubygem-pumarpmlinux enterprise high availability extension 15 sp24.3.12-150000.3.9.1Not reportedSUSE-SU-2022:3571-1Not reported
Suserubygem-pumarpmlinux enterprise high availability extension 15 sp34.3.12-150000.3.9.1Not reportedSUSE-SU-2022:3571-1Not reported
Suserubygem-pumarpmlinux enterprise high availability extension 15 sp44.3.12-150000.3.9.1Not reportedSUSE-SU-2022:3571-1Not reported
Opensuserubygem-pumarpmleap 15.34.3.12-150000.3.9.1Not reportedSUSE-SU-2022:3571-1Not reported
Opensuserubygem-pumarpmleap 15.44.3.12-150000.3.9.1Not reportedSUSE-SU-2022:3571-1Not reported
Ubuntupumadebpro5.5.2-2ubuntu2+esm1Not reportedUBUNTU-CVE-2022-24790Not reported
Opensuserubygem-puma-4rpmtumbleweed4.3.12-1.1Not reportedOPENSUSE-SU-2024:12032-1Not reported

[Debian bug #1008723]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [puma]Fixed
    Details (2)

    • 5.6.5-3+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 5.6.4-1

      dsa · puma · debian · bookworm

    • 5.6.5-3+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 5.6.4-1

      dsa · puma · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]