Is CVE-2026-68006 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-68006 being exploited in the wild.

How severe is CVE-2026-68006?

Critical severity, with a CVSS score of 9.1, published 10 September 2026.

Is there a fix for CVE-2026-68006?

A patch was published on 2026: Puma 8.0.3, 7.2.2, 6.4.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-68006 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-68006?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-68006: Puma HTTP request smuggling via underscore header parsing

CVE-2026-68006 · Severity: critical · CVSS 9.1 · Published 2026-09-10

Puma is a widely-used web server that processes HTTP requests from clients and proxies. Due to a bug in its HTTP header parser, an attacker can send specially-crafted requests with underscores in header names (e.g., Transfer_Encoding instead of Transfer-Encoding) that Puma fails to recognize, while upstream proxies or CDNs may still process them. This disagreement allows an attacker to inject hidden requests into the connection stream, bypassing access controls, poisoning caches, or stealing session data from legitimate users.

Quick answers

Is CVE-2026-68006 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-68006 being exploited in the wild.
How severe is CVE-2026-68006?: Critical severity, with a CVSS score of 9.1, published 10 September 2026.
Which products and versions are affected?: Puma Puma 5.0.0 through 8.0.2.
Is there a fix for CVE-2026-68006?: A patch was published on 2026: Puma 8.0.3, 7.2.2, 6.4.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-68006 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-68006?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an HTTP request smuggling flaw in Puma's HTTP/1.1 parser caused by inconsistent header name normalization. The C extension function snake_upcase_char (in ext/puma_http11/http11_parser.rl) converts underscores in header names to commas (e.g., Transfer_Encoding becomes TRANSFER,ENCODING), but the body-parsing logic in setup_body (lib/puma/client.rb) only checks for standard names with underscores (HTTP_TRANSFER_ENCODING, CONTENT_LENGTH). The UNMASKABLE_HEADERS allowlist preserves comma-containing keys without normalizing them back, causing setup_body to fail header lookups. If a front-end proxy (nginx, AWS ALB) accepts underscore headers and interprets them normally, the proxy and Puma will desynchronize on request boundaries, enabling CL.TE (Content-Length vs. Transfer-Encoding) and CL.CL smuggling attacks. Patches are available in Puma 8.0.3, 7.2.2, and 6.4.4.

Affected products

Puma Puma 5.0.0 through 8.0.2

Timeline

2026-07-29: disclosed
2026-09-10: advisory
2026: patched: Puma 8.0.3, 7.2.2, 6.4.4

References

https://github.com/czx1111/cve/issues/1

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.