Technology · RubyGems
puma (RubyGems) vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 15 vulnerabilities in puma (RubyGems): 0 in the last 7 days and 1 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-68006, was published on 10 September 2026. Nothing was published in the last eight weeks.
- Last 7 days
- 0
- Last 90 days
- 1
- Critical, all time
- 1
- Exploited in the wild
- 0
About puma (RubyGems)
A multi-threaded HTTP server for Ruby and Rack applications.
Latest puma (RubyGems) vulnerabilities
- CVE-2026-68006: Puma HTTP request smuggling via underscore header parsingcriticalCVSS 9.1EPSS 0.5%
- CVE-2026-47737: Puma source IP spoofing via PROXY protocol injectionhighCVSS 7.5EPSS 0.3%
- CVE-2026-47736: Puma uncontrolled resource consumption in PROXY protocol v1 parserhighCVSS 7.5EPSS 0.6%
- CVE-2024-45614: Puma's header normalization allows for client to clobber proxy set headerslowCVSS 3.1EPSS 0.6%
- CVE-2024-21647: Puma HTTP Request/Response Smuggling vulnerabilitylowCVSS 3.1EPSS 1.0%
- CVE-2023-40175: Puma HTTP Request/Response Smuggling vulnerabilitylowCVSS 3.1EPSS 0.9%
- CVE-2022-24790: Puma vulnerable to HTTP Request SmugglinglowCVSS 3.1EPSS 2.2%
- CVE-2022-23634: Puma used with Rails may lead to Information ExposurelowCVSS 3.1EPSS 2.1%
- CVE-2021-41136: Puma with proxy which forwards LF characters as line endings could allow HTTP request smugglinglowCVSS 3.1EPSS 1.2%
- CVE-2021-29509: Puma's Keepalive Connections Causing Denial Of ServicelowCVSS 3.1EPSS 1.6%
- CVE-2020-11077: HTTP Smuggling via Transfer-Encoding Header in PumalowCVSS 3.1EPSS 2.8%
- CVE-2020-11076: HTTP Smuggling via Transfer-Encoding Header in PumalowCVSS 3.1EPSS 4.1%
- CVE-2020-5249: HTTP Response Splitting (Early Hints) in PumalowCVSS 3.1EPSS 1.6%
- CVE-2020-5247: HTTP Response Splitting in PumalowCVSS 3.1EPSS 2.5%
- CVE-2019-16770: A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attacklowCVSS 3.1EPSS 2.0%
Most severe puma (RubyGems) vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-68006: Puma HTTP request smuggling via underscore header parsingcriticalCVSS 9.1EPSS 0.5%
- CVE-2026-47736: Puma uncontrolled resource consumption in PROXY protocol v1 parserhighCVSS 7.5EPSS 0.6%
- CVE-2026-47737: Puma source IP spoofing via PROXY protocol injectionhighCVSS 7.5EPSS 0.3%
- CVE-2020-11076: HTTP Smuggling via Transfer-Encoding Header in PumalowCVSS 3.1EPSS 4.1%
- CVE-2020-11077: HTTP Smuggling via Transfer-Encoding Header in PumalowCVSS 3.1EPSS 2.8%
- CVE-2020-5247: HTTP Response Splitting in PumalowCVSS 3.1EPSS 2.5%
- CVE-2022-24790: Puma vulnerable to HTTP Request SmugglinglowCVSS 3.1EPSS 2.2%
- CVE-2022-23634: Puma used with Rails may lead to Information ExposurelowCVSS 3.1EPSS 2.1%
- CVE-2019-16770: A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attacklowCVSS 3.1EPSS 2.0%
- CVE-2021-29509: Puma's Keepalive Connections Causing Denial Of ServicelowCVSS 3.1EPSS 1.6%
Vulnerabilities per week
Nothing was published in the last eight weeks. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 1 | 1 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many puma (RubyGems) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/puma)<a href="https://junglewise.ai/threats/technologies/puma"><img src="https://junglewise.ai/threats/technologies/puma/badge.svg" alt="puma (RubyGems) vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/puma.json, and this page as text at https://junglewise.ai/threats/technologies/puma.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "puma (RubyGems) vulnerabilities", https://junglewise.ai/threats/technologies/puma, 13 November 2026.