Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:deb/debian/puma@6.4.2-1?distro=trixie
Typedeb
Namespacedebian
Namepuma
Version6.4.2-1
Qualifiers
distro trixie
Subpath
Is_vulnerablefalse
Next_non_vulnerable_version6.4.3-1
Latest_non_vulnerable_version6.6.0-4
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-nxhw-rdtz-zyar
vulnerability_id VCID-nxhw-rdtz-zyar
summary 
Puma HTTP Request/Response Smuggling vulnerability
### Impact
Prior to versions 6.4.2 and 5.6.8, puma exhibited dangerous behavior when parsing chunked transfer encoding bodies.

Fixed versions limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption.

### Patches

The vulnerability has been fixed in 6.4.2 and 5.6.8.

### Workarounds

No known workarounds.

### References

* [HTTP Request Smuggling](https://portswigger.net/web-security/request-smuggling)
* Open an issue in [Puma](https://github.com/puma/puma)
* See our [security policy](https://github.com/puma/puma/security/policy)
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-21647.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-21647.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-21647
reference_id
reference_type
scores
0
value 0.0246
scoring_system epss
scoring_elements 0.85262
published_at 2026-04-21T12:55:00Z
1
value 0.0246
scoring_system epss
scoring_elements 0.85263
published_at 2026-04-18T12:55:00Z
2
value 0.0246
scoring_system epss
scoring_elements 0.85261
published_at 2026-04-16T12:55:00Z
3
value 0.0246
scoring_system epss
scoring_elements 0.85241
published_at 2026-04-13T12:55:00Z
4
value 0.0246
scoring_system epss
scoring_elements 0.85245
published_at 2026-04-12T12:55:00Z
5
value 0.0246
scoring_system epss
scoring_elements 0.85247
published_at 2026-04-11T12:55:00Z
6
value 0.0246
scoring_system epss
scoring_elements 0.85225
published_at 2026-04-08T12:55:00Z
7
value 0.0246
scoring_system epss
scoring_elements 0.85203
published_at 2026-04-07T12:55:00Z
8
value 0.0246
scoring_system epss
scoring_elements 0.85201
published_at 2026-04-04T12:55:00Z
9
value 0.0246
scoring_system epss
scoring_elements 0.85183
published_at 2026-04-02T12:55:00Z
10
value 0.0246
scoring_system epss
scoring_elements 0.85233
published_at 2026-04-09T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-21647
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21647
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21647
3
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
4
reference_url https://github.com/puma/puma
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/puma/puma
5
reference_url https://github.com/puma/puma/commit/5fc43d73b6ff193325e657a24ed76dec79133e93
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-08T15:56:45Z/
url https://github.com/puma/puma/commit/5fc43d73b6ff193325e657a24ed76dec79133e93
6
reference_url https://github.com/puma/puma/commit/60d5ee3734adc8cee85c3f0561af392448fe19b7
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/puma/puma/commit/60d5ee3734adc8cee85c3f0561af392448fe19b7
7
reference_url https://github.com/puma/puma/commit/bbb880ffb6debbfdea535b4b3eb2204d49ae151d
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/puma/puma/commit/bbb880ffb6debbfdea535b4b3eb2204d49ae151d
8
reference_url https://github.com/puma/puma/security/advisories/GHSA-c2f4-cvqm-65w2
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3
scoring_elements
1
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
2
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
3
value MODERATE
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-08T15:56:45Z/
url https://github.com/puma/puma/security/advisories/GHSA-c2f4-cvqm-65w2
9
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2024-21647.yml
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2024-21647.yml
10
reference_url https://lists.debian.org/debian-lts-announce/2024/11/msg00004.html
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2024/11/msg00004.html
11
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-21647
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-21647
12
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1060345
reference_id 1060345
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1060345
13
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2257340
reference_id 2257340
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2257340
14
reference_url https://github.com/advisories/GHSA-c2f4-cvqm-65w2
reference_id GHSA-c2f4-cvqm-65w2
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-c2f4-cvqm-65w2
15
reference_url https://usn.ubuntu.com/6597-1/
reference_id USN-6597-1
reference_type
scores
url https://usn.ubuntu.com/6597-1/
16
reference_url https://usn.ubuntu.com/6682-1/
reference_id USN-6682-1
reference_type
scores
url https://usn.ubuntu.com/6682-1/
fixed_packages
0
url pkg:deb/debian/puma@4.3.8-1%2Bdeb11u2?distro=trixie
purl pkg:deb/debian/puma@4.3.8-1%2Bdeb11u2?distro=trixie
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fhu7-fyha-9khj
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/puma@4.3.8-1%252Bdeb11u2%3Fdistro=trixie
1
url pkg:deb/debian/puma@4.3.8-1%2Bdeb11u3?distro=trixie
purl pkg:deb/debian/puma@4.3.8-1%2Bdeb11u3?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/puma@4.3.8-1%252Bdeb11u3%3Fdistro=trixie
2
url pkg:deb/debian/puma@5.6.5-3%2Bdeb12u1?distro=trixie
purl pkg:deb/debian/puma@5.6.5-3%2Bdeb12u1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/puma@5.6.5-3%252Bdeb12u1%3Fdistro=trixie
3
url pkg:deb/debian/puma@6.4.2-1?distro=trixie
purl pkg:deb/debian/puma@6.4.2-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/puma@6.4.2-1%3Fdistro=trixie
4
url pkg:deb/debian/puma@6.6.0-4?distro=trixie
purl pkg:deb/debian/puma@6.6.0-4?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/puma@6.6.0-4%3Fdistro=trixie
aliases CVE-2024-21647, GHSA-c2f4-cvqm-65w2
risk_score 3.4
exploitability 0.5
weighted_severity 6.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-nxhw-rdtz-zyar
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:deb/debian/puma@6.4.2-1%3Fdistro=trixie