Search for packages
| purl | pkg:deb/debian/puma@5.6.4-1?distro=trixie |
| Vulnerability | Summary | Fixed by |
|---|---|---|
| This package is not known to be affected by vulnerabilities. | ||
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-gkf9-7a9x-nkh4 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The vulnerability has been fixed in 5.6.4 and 4.3.12. Users are advised to upgrade as soon as possible. Workaround: when deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard. |
CVE-2022-24790
GHSA-h99w-9q5r-gjq9 |
| VCID-jwun-grgg-2uet | Exposure of information in Action Pack Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests. This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used. |
CVE-2022-23633
CVE-2022-23634 GHSA-rmj8-8hhh-gv5h GHSA-wh98-p28r-vrc9 |
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-16T11:24:38.600767+00:00 | Debian Importer | Fixing | VCID-gkf9-7a9x-nkh4 | https://security-tracker.debian.org/tracker/data/json | 38.4.0 |
| 2026-04-16T08:51:22.177861+00:00 | Debian Importer | Fixing | VCID-jwun-grgg-2uet | https://security-tracker.debian.org/tracker/data/json | 38.4.0 |
| 2026-04-13T07:46:21.379221+00:00 | Debian Importer | Fixing | VCID-gkf9-7a9x-nkh4 | https://security-tracker.debian.org/tracker/data/json | 38.3.0 |
| 2026-04-11T17:56:52.721800+00:00 | Debian Importer | Fixing | VCID-jwun-grgg-2uet | https://security-tracker.debian.org/tracker/data/json | 38.3.0 |
| 2026-04-03T07:50:24.860858+00:00 | Debian Importer | Fixing | VCID-gkf9-7a9x-nkh4 | https://security-tracker.debian.org/tracker/data/json | 38.1.0 |
| 2026-04-03T07:50:24.819833+00:00 | Debian Importer | Fixing | VCID-jwun-grgg-2uet | https://security-tracker.debian.org/tracker/data/json | 38.1.0 |