CVE-2022-24790: HTTP Request Smuggling in puma

Published Mar 30, 2022
·
Updated

A HTTP request smuggling flaw was found in puma. This issue occurs when using puma behind a proxy. Puma does not validate incoming HTTP requests, as per RFC specification, leading to loss of integrity.

Other sources

Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The vulnerability has been fixed in 5.6.4 and 4.3.12. Users are advised to upgrade as soon as possible. Workaround: when deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard.

Ubuntu

Affected Software

14 affected componentsFixes available
redhat/rubygem-puma<0:4.3.12-1.el7
0:4.3.12-1.el7
redhat/tfm-rubygem-puma<0:4.3.12-1.el7
0:4.3.12-1.el7
redhat/puma<5.6.4
5.6.4
redhat/puma<4.3.12
4.3.12
debian/puma<=3.12.0-2+deb10u2, <=4.3.8-1
3.12.0-2+deb10u34.3.8-1+deb11u25.6.5-36.4.2-4
ubuntu/puma<3.12.4-1ubuntu2+
3.12.4-1ubuntu2+
ubuntu/puma<5.5.2-2ubuntu2+
5.5.2-2ubuntu2+
Puma Puma Ruby<4.3.12
Puma Puma Ruby>=5.0.0<5.6.4
Debian Debian Linux=10.0
Debian Debian Linux=11.0
Fedoraproject Fedora=35
Fedoraproject Fedora=36
Fedoraproject Fedora=37

Event History

Mar 30, 2022
CVE Published
12:00 AM
CVE Published
via MITRE·09:50 PM
Data Sourced
via MITRE·09:50 PM
DescriptionSeverityWeakness
Mar 7, 2024
Data Sourced
via Launchpad·04:38 PM
Description

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is CVE-2022-24790?

CVE-2022-24790 is a HTTP request smuggling flaw found in Puma, a multi-threaded HTTP server for Ruby/Rack applications.

2

How severe is CVE-2022-24790?

CVE-2022-24790 has a severity rating of 7.5 (Critical).

3

What is the affected software?

The affected software includes Puma versions up to and including 5.6.4 and Rubygem Puma up to and including version 4.3.12.

4

How can I fix CVE-2022-24790?

To fix CVE-2022-24790, update to Puma version 5.6.5 or higher, or Rubygem Puma version 4.3.13 or higher.

5

Where can I find more information about CVE-2022-24790?

More information about CVE-2022-24790 can be found at the following references: [GitHub Commit](https://github.com/puma/puma/commit/5bb7d202e24dec00a898dca4aa11db391d7787a5), [GitHub Security Advisory](https://github.com/puma/puma/security/advisories/GHSA-h99w-9q5r-gjq9), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2071623).

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203