Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-pjdk-99cg-skg8
Vulnerability ID VCID-pjdk-99cg-skg8
Aliases CVE-2023-40175
GHSA-68xg-gqqm-vgj8
Summary Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is highly dependent on the nature of the web site using puma is. This could be caused by either incorrect parsing of trailing fields in chunked transfer encoding bodies or by parsing of blank/zero-length Content-Length headers. Both issues have been addressed and this vulnerability has been fixed in versions 6.3.1 and 5.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Status Published
Exploitability 0.5
Weighted Severity 6.6
Risk 3.3
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-40175.json
epss 0.00377 https://api.first.org/data/v1/epss?cve=CVE-2023-40175
cvssv3.1 7.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 9.8 https://github.com/puma/puma
generic_textual CRITICAL https://github.com/puma/puma
cvssv3.1 7.3 https://github.com/puma/puma/commit/690155e7d644b80eeef0a6094f9826ee41f1080a
cvssv3.1 9.8 https://github.com/puma/puma/commit/690155e7d644b80eeef0a6094f9826ee41f1080a
generic_textual CRITICAL https://github.com/puma/puma/commit/690155e7d644b80eeef0a6094f9826ee41f1080a
ssvc Track https://github.com/puma/puma/commit/690155e7d644b80eeef0a6094f9826ee41f1080a
cvssv3.1 9.8 https://github.com/puma/puma/commit/7405a219801dcebc0ad6e0aa108d4319ca23f662
generic_textual CRITICAL https://github.com/puma/puma/commit/7405a219801dcebc0ad6e0aa108d4319ca23f662
cvssv3.1 9.8 https://github.com/puma/puma/commit/ed0f2f94b56982c687452504b95d5f1fbbe3eed1
generic_textual CRITICAL https://github.com/puma/puma/commit/ed0f2f94b56982c687452504b95d5f1fbbe3eed1
cvssv3.1 9.8 https://github.com/puma/puma/releases/tag/v5.6.7
generic_textual CRITICAL https://github.com/puma/puma/releases/tag/v5.6.7
cvssv3.1 9.8 https://github.com/puma/puma/releases/tag/v6.3.1
generic_textual CRITICAL https://github.com/puma/puma/releases/tag/v6.3.1
cvssv3 6.5 https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8
cvssv3.1 7.3 https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8
cvssv3.1 9.8 https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8
generic_textual CRITICAL https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8
ssvc Track https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8
cvssv3.1 9.8 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2023-40175.yml
generic_textual CRITICAL https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2023-40175.yml
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2023-40175
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2023-40175
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-40175.json
https://api.first.org/data/v1/epss?cve=CVE-2023-40175
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/puma/puma
https://github.com/puma/puma/commit/690155e7d644b80eeef0a6094f9826ee41f1080a
https://github.com/puma/puma/commit/7405a219801dcebc0ad6e0aa108d4319ca23f662
https://github.com/puma/puma/commit/ed0f2f94b56982c687452504b95d5f1fbbe3eed1
https://github.com/puma/puma/releases/tag/v5.6.7
https://github.com/puma/puma/releases/tag/v6.3.1
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2023-40175.yml
1050079 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1050079
2232729 https://bugzilla.redhat.com/show_bug.cgi?id=2232729
CVE-2023-40175 https://nvd.nist.gov/vuln/detail/CVE-2023-40175
GHSA-68xg-gqqm-vgj8 https://github.com/advisories/GHSA-68xg-gqqm-vgj8
GHSA-68xg-gqqm-vgj8 https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8
RHSA-2024:0797 https://access.redhat.com/errata/RHSA-2024:0797
USN-6399-1 https://usn.ubuntu.com/6399-1/
USN-6682-1 https://usn.ubuntu.com/6682-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-40175.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/puma/puma
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/puma/puma/commit/690155e7d644b80eeef0a6094f9826ee41f1080a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/puma/puma/commit/690155e7d644b80eeef0a6094f9826ee41f1080a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-07T20:03:28Z/ Found at https://github.com/puma/puma/commit/690155e7d644b80eeef0a6094f9826ee41f1080a
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/puma/puma/commit/7405a219801dcebc0ad6e0aa108d4319ca23f662
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/puma/puma/commit/ed0f2f94b56982c687452504b95d5f1fbbe3eed1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/puma/puma/releases/tag/v5.6.7
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/puma/puma/releases/tag/v6.3.1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-07T20:03:28Z/ Found at https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2023-40175.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-40175
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.59579
EPSS Score 0.00377
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T21:01:38.218074+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/gitlab-puma/CVE-2023-40175.yml 38.6.0