Ruby/puma/5.6.4

Puma is a simple, fast, threaded, and highly parallel HTTP 1.1 server for Ruby/Rack applications. Puma is intended for use in both development and production environments. It's great for highly parallel Ruby implementations such as Rubinius and JRuby as well as as providing process worker support to support CRuby well.

https://rubygems.org/gems/puma
BSD-3-Clause

1 Security Vulnerabilities

Puma HTTP Request/Response Smuggling vulnerability

Published date: 2024-01-08T15:56:48Z
CVE: CVE-2024-21647
Links:

Impact

Prior to versions 6.4.2 and 5.6.8, puma exhibited dangerous behavior when parsing chunked transfer encoding bodies.

Fixed versions limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption.

Patches

The vulnerability has been fixed in 6.4.2 and 5.6.8.

Workarounds

No known workarounds.

References

Affected versions: ["5.0.4", "5.0.3", "5.0.2", "5.0.1", "5.0.0", "5.0.0.beta2", "5.0.0.beta1", "4.3.6", "4.3.5", "4.3.4", "4.3.3", "4.3.1", "4.3.0", "4.2.1", "4.2.0", "4.1.1", "4.1.0", "4.0.1", "4.0.0", "3.12.6", "3.12.5", "3.12.4", "3.12.2", "3.12.1", "3.12.0", "3.11.4", "3.11.3", "3.11.2", "3.11.1", "3.11.0", "3.10.0", "3.9.1", "3.9.0", "3.8.2", "3.8.1", "3.8.0", "3.7.1", "3.7.0", "3.6.2", "3.6.1", "3.6.0", "3.5.2", "3.5.1", "3.5.0", "3.4.0", "3.3.0", "3.2.0", "3.1.1", "3.1.0", "3.0.2", "3.0.1", "3.0.0", "3.0.0.rc1", "2.16.0", "2.15.3", "2.15.2", "2.15.1", "2.15.0", "2.14.0", "2.13.4", "2.13.3", "2.13.2", "2.13.1", "2.13.0", "2.12.3", "2.12.2", "2.12.1", "2.12.0", "2.11.3", "2.11.2", "2.11.1", "2.11.0", "2.10.2", "2.10.1", "2.10.0", "2.9.2", "2.9.1", "2.9.0", "2.8.2", "2.8.1", "2.8.0", "2.7.1", "2.7.0", "2.6.0", "2.5.1", "2.5.0", "2.4.1", "2.4.0", "2.3.2", "2.3.1", "2.3.0", "2.2.2", "2.2.1", "2.2.0", "2.1.1", "2.1.0", "2.0.1", "2.0.0", "2.0.0.b7", "2.0.0.b6", "2.0.0.b5", "2.0.0.b4", "2.0.0.b3", "2.0.0.b2", "2.0.0.b1", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.5.0", "1.4.0", "1.3.1", "1.3.0", "1.2.2", "1.2.1", "1.2.0", "1.1.1", "1.1.0", "1.0.0", "0.9.5", "0.9.4", "0.9.3", "0.9.2", "0.9.1", "0.9.0", "0.8.2", "0.8.1", "0.8.0", "5.1.0", "4.3.7", "5.1.1", "5.2.0", "5.2.1", "5.2.2", "5.3.0", "5.3.1", "4.3.8", "5.3.2", "5.4.0", "5.5.0", "5.5.1", "4.3.9", "5.5.2", "4.3.10", "5.6.0", "5.6.1", "5.6.2", "4.3.11", "5.6.4", "4.3.12", "5.6.5", "5.6.6", "5.6.7", "6.0.0", "6.0.1", "6.0.2", "6.1.0", "6.1.1", "6.2.1", "6.2.0", "6.2.2", "6.3.0", "6.3.1", "6.4.0", "6.4.1"]
Secure versions: [6.4.2, 5.6.8]
Recommendation: Update to version 6.4.2.

167 Other Versions

Version License Security Released
2.13.2 BSD-3-Clause 22 2015-08-15 - 21:52 over 8 years
2.13.1 BSD-3-Clause 22 2015-08-15 - 17:10 over 8 years
2.13.0 BSD-3-Clause 22 2015-08-15 - 01:35 over 8 years
2.12.3 BSD-3-Clause 22 2015-08-04 - 05:19 over 8 years
2.12.2 BSD-3-Clause 22 2015-07-17 - 18:53 almost 9 years
2.12.1 BSD-3-Clause 22 2015-07-16 - 17:08 almost 9 years
2.12.0 BSD-3-Clause 22 2015-07-14 - 19:03 almost 9 years
2.11.3 BSD-3-Clause 22 2015-05-19 - 04:12 almost 9 years
2.11.2 BSD-3-Clause 22 2015-04-13 - 16:22 about 9 years
2.11.1 BSD-3-Clause 22 2015-02-11 - 23:51 about 9 years
2.11.0 BSD-3-Clause 22 2015-01-20 - 19:01 over 9 years
2.10.2 BSD-3-Clause 22 2014-11-27 - 07:08 over 9 years
2.10.1 BSD-3-Clause 22 2014-11-24 - 19:50 over 9 years
2.10.0 BSD-3-Clause 22 2014-11-24 - 03:58 over 9 years
2.9.2 BSD-3-Clause 22 2014-10-30 - 14:58 over 9 years
2.9.1 BSD-3-Clause 22 2014-09-05 - 18:41 over 9 years
2.9.0 BSD-3-Clause 22 2014-07-13 - 01:03 almost 10 years
2.8.2 BSD 22 2014-04-12 - 21:11 about 10 years
2.8.1 BSD 22 2014-03-06 - 19:39 about 10 years
2.8.0 BSD 22 2014-02-28 - 22:50 about 10 years
2.7.1 UNKNOWN 22 2013-12-05 - 17:58 over 10 years
2.7.0 UNKNOWN 22 2013-12-04 - 00:56 over 10 years
2.6.0 UNKNOWN 22 2013-09-13 - 17:06 over 10 years
2.5.1 UNKNOWN 22 2013-08-13 - 23:19 over 10 years
2.5.0 UNKNOWN 22 2013-08-08 - 23:28 over 10 years
2.4.1 UNKNOWN 22 2013-08-07 - 23:45 over 10 years
2.4.0 UNKNOWN 22 2013-07-22 - 21:44 almost 11 years
2.3.2 UNKNOWN 22 2013-07-09 - 05:48 almost 11 years
2.3.1 UNKNOWN 22 2013-07-06 - 21:01 almost 11 years
2.3.0 UNKNOWN 22 2013-07-06 - 05:23 almost 11 years
2.2.2 UNKNOWN 22 2013-07-02 - 18:42 almost 11 years
2.2.1 UNKNOWN 22 2013-07-02 - 18:25 almost 11 years
2.2.0 UNKNOWN 22 2013-07-02 - 00:54 almost 11 years
2.1.1 UNKNOWN 22 2013-06-20 - 22:57 almost 11 years
2.1.0 UNKNOWN 22 2013-06-18 - 22:02 almost 11 years
2.0.1 UNKNOWN 22 2013-04-30 - 18:18 about 11 years
2.0.0 UNKNOWN 22 2013-04-29 - 23:20 about 11 years
2.0.0.b7 UNKNOWN 22 2013-03-19 - 05:34 about 11 years
2.0.0.b6 UNKNOWN 22 2013-02-07 - 02:21 about 11 years
2.0.0.b5 UNKNOWN 22 2013-02-06 - 06:51 about 11 years
2.0.0.b4 UNKNOWN 22 2012-12-13 - 05:49 over 11 years
2.0.0.b3 UNKNOWN 22 2012-11-22 - 20:57 over 11 years
2.0.0.b2 UNKNOWN 22 2012-11-19 - 04:48 over 11 years
2.0.0.b1 UNKNOWN 22 2012-09-12 - 05:55 over 11 years
1.6.3 UNKNOWN 22 2012-09-04 - 17:16 over 11 years
1.6.2 UNKNOWN 22 2012-08-27 - 18:03 over 11 years
1.6.1 UNKNOWN 22 2012-08-12 - 15:13 over 11 years
1.6.0 UNKNOWN 22 2012-08-12 - 05:44 over 11 years
1.5.0 UNKNOWN 22 2012-07-19 - 23:42 almost 12 years
1.4.0 UNKNOWN 22 2012-06-04 - 19:30 almost 12 years
1.3.1 UNKNOWN 22 2012-05-16 - 04:06 almost 12 years
1.3.0 UNKNOWN 22 2012-05-08 - 21:32 almost 12 years
1.2.2 UNKNOWN 22 2012-04-28 - 17:12 about 12 years
1.2.1 UNKNOWN 22 2012-04-11 - 19:20 about 12 years
1.2.0 UNKNOWN 22 2012-04-11 - 18:43 about 12 years
1.1.1 UNKNOWN 22 2012-03-31 - 02:40 about 12 years
1.1.0 UNKNOWN 22 2012-03-30 - 23:50 about 12 years
1.0.0 UNKNOWN 22 2012-03-30 - 17:57 about 12 years
0.9.5 UNKNOWN 22 2012-03-03 - 00:39 about 12 years
0.9.4 UNKNOWN 22 2012-03-02 - 19:12 about 12 years
0.9.3 UNKNOWN 22 2012-01-10 - 17:24 over 12 years
0.9.2 UNKNOWN 22 2011-12-19 - 22:20 over 12 years
0.9.1 UNKNOWN 22 2011-12-06 - 23:01 over 12 years
0.9.0 UNKNOWN 22 2011-12-06 - 00:13 over 12 years
0.8.2 UNKNOWN 22 2011-11-28 - 18:50 over 12 years
0.8.1 UNKNOWN 22 2011-10-25 - 22:08 over 12 years
0.8.0 UNKNOWN 22 2011-10-25 - 21:41 over 12 years