VulnerableCode Package Details - pkg:gem/puma@2.10.0

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:gem/puma@2.10.0

Essentials
History (13)

purl	pkg:gem/puma@2.10.0

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk	3.1

Vulnerabilities affecting this package (11)

Vulnerability	Summary	Fixed by
VCID-6gcd-m795-k3ft Aliases: CVE-2020-11076 GHSA-x7jg-6pwg-fx5h		3.12.5 Affected by 8 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 4.3.4 Affected by 8 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-99ek-f3bn-jke8 Aliases: CVE-2021-41136 GHSA-48w2-rm65-62xx		4.3.9 Affected by 5 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 5.5.1 Affected by 5 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-cvbj-zb4m-17cr Aliases: CVE-2020-5247 GHSA-84j7-475p-hp8v		3.12.4 Affected by 9 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 4.3.3 Affected by 9 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-dzqk-k84r-jufc Aliases: CVE-2024-45614 GHSA-9hf4-67fc-4vf4		5.6.9 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 6.4.3 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-n7n1-3x7n-1bca Aliases: CVE-2024-21647 GHSA-c2f4-cvqm-65w2	Puma HTTP Request/Response Smuggling vulnerability Prior to versions 6.4.2 and 5.6.8, puma exhibited dangerous behavior when parsing chunked transfer encoding bodies. Fixed versions limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption.	5.6.8 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 6.4.2 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-njvx-231r-kudy Aliases: CVE-2019-16770 GHSA-7xx3-m584-x994		3.12.2 Affected by 10 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 4.3.1 Affected by 10 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-npbj-z6u2-53ay Aliases: CVE-2022-24790 GHSA-h99w-9q5r-gjq9		4.3.12 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 5.6.4 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-pjdk-99cg-skg8 Aliases: CVE-2023-40175 GHSA-68xg-gqqm-vgj8	Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is highly dependent on the nature of the web site using puma is. This could be caused by either incorrect parsing of trailing fields in chunked transfer encoding bodies or by parsing of blank/zero-length Content-Length headers. Both issues have been addressed and this vulnerability has been fixed in versions 6.3.1 and 5.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.	5.6.7 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 6.3.1 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-s21w-r5mn-s7e9 Aliases: CVE-2020-11077 GHSA-w64w-qqph-5gxm		3.12.6 Affected by 8 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 4.3.5 Affected by 8 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-th9a-z3uc-xqgh Aliases: CVE-2020-5249 GHSA-33vf-4xgg-9r58		3.12.4 Affected by 9 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 4.3.3 Affected by 9 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-yb33-bhma-nbbq Aliases: CVE-2022-23634 GHSA-rmj8-8hhh-gv5h		4.3.11 Affected by 4 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 5.6.2 Affected by 4 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-05-31T10:19:50.572713+00:00	Ruby Importer	Affected by	VCID-dzqk-k84r-jufc	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2024-45614.yml	38.6.0
2026-05-31T10:19:14.094200+00:00	Ruby Importer	Affected by	VCID-n7n1-3x7n-1bca	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2024-21647.yml	38.6.0
2026-05-31T10:19:04.950433+00:00	Ruby Importer	Affected by	VCID-pjdk-99cg-skg8	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2023-40175.yml	38.6.0
2026-05-31T10:17:46.878456+00:00	Ruby Importer	Affected by	VCID-npbj-z6u2-53ay	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2022-24790.yml	38.6.0
2026-05-31T10:17:43.116002+00:00	Ruby Importer	Affected by	VCID-yb33-bhma-nbbq	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2022-23634.yml	38.6.0
2026-05-31T10:17:27.438098+00:00	Ruby Importer	Affected by	VCID-99ek-f3bn-jke8	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2021-41136.yml	38.6.0
2026-05-31T10:17:05.805052+00:00	Ruby Importer	Affected by	VCID-6gcd-m795-k3ft	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2020-11076.yml	38.6.0
2026-05-31T10:17:04.947536+00:00	Ruby Importer	Affected by	VCID-s21w-r5mn-s7e9	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2020-11077.yml	38.6.0
2026-05-31T10:17:00.566806+00:00	Ruby Importer	Affected by	VCID-th9a-z3uc-xqgh	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2020-5249.yml	38.6.0
2026-05-31T10:16:59.781843+00:00	Ruby Importer	Affected by	VCID-cvbj-zb4m-17cr	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2020-5247.yml	38.6.0
2026-05-31T10:16:56.031502+00:00	Ruby Importer	Affected by	VCID-njvx-231r-kudy	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2019-16770.yml	38.6.0
2026-05-31T10:03:14.301922+00:00	GitLab Importer	Affected by	VCID-th9a-z3uc-xqgh	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/puma/CVE-2020-5249.yml	38.6.0
2026-05-31T10:03:12.325339+00:00	GitLab Importer	Affected by	VCID-cvbj-zb4m-17cr	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/puma/CVE-2020-5247.yml	38.6.0