VulnerableCode Package Details - pkg:alpm/archlinux/ruby-puma@5.6.3-1

Search for packages

Vulnerability	Summary	Fixed by
VCID-5zm7-c7nu-quad Aliases: CVE-2021-41136 GHSA-48w2-rm65-62xx	Puma with proxy which forwards LF characters as line endings could allow HTTP request smuggling Prior to `puma` version 5.5.0, using `puma` with a proxy which forwards LF characters as line endings could allow HTTP request smuggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. This behavior (forwarding LF characters as line endings) is very uncommon amongst proxy servers, so we have graded the impact here as "low". Puma is only aware of a single proxy server which has this behavior. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client.	5.6.4-1 Affected by 0 other vulnerabilities.
VCID-gkf9-7a9x-nkh4 Aliases: CVE-2022-24790 GHSA-h99w-9q5r-gjq9	Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The vulnerability has been fixed in 5.6.4 and 4.3.12. Users are advised to upgrade as soon as possible. Workaround: when deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard.	5.6.4-1 Affected by 0 other vulnerabilities.
VCID-jwun-grgg-2uet Aliases: CVE-2022-23633 CVE-2022-23634 GHSA-rmj8-8hhh-gv5h GHSA-wh98-p28r-vrc9	Exposure of information in Action Pack Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is not notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests. This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.	5.6.4-1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-5zm7-c7nu-quad
Aliases:
CVE-2021-41136
GHSA-48w2-rm65-62xx

Puma with proxy which forwards LF characters as line endings could allow HTTP request smuggling Prior to `puma` version 5.5.0, using `puma` with a proxy which forwards LF characters as line endings could allow HTTP request smuggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. This behavior (forwarding LF characters as line endings) is very uncommon amongst proxy servers, so we have graded the impact here as "low". Puma is only aware of a single proxy server which has this behavior. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client.

5.6.4-1
Affected by 0 other vulnerabilities.

VCID-gkf9-7a9x-nkh4
Aliases:
CVE-2022-24790
GHSA-h99w-9q5r-gjq9

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The vulnerability has been fixed in 5.6.4 and 4.3.12. Users are advised to upgrade as soon as possible. Workaround: when deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard.

5.6.4-1
Affected by 0 other vulnerabilities.

VCID-jwun-grgg-2uet
Aliases:
CVE-2022-23633
CVE-2022-23634
GHSA-rmj8-8hhh-gv5h
GHSA-wh98-p28r-vrc9

Exposure of information in Action Pack Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests. This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.

5.6.4-1
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T18:24:02.376519+00:00	Arch Linux Importer	Affected by	VCID-5zm7-c7nu-quad	https://security.archlinux.org/AVG-2764	38.0.0
2026-04-01T18:24:02.354567+00:00	Arch Linux Importer	Affected by	VCID-jwun-grgg-2uet	https://security.archlinux.org/AVG-2764	38.0.0
2026-04-01T18:24:02.332635+00:00	Arch Linux Importer	Affected by	VCID-gkf9-7a9x-nkh4	https://security.archlinux.org/AVG-2764	38.0.0