CVE-2026-68006
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary code in the context of the Puma application server, potentially leading to full compromise of the service.
Recommendation
Update Puma to version 8.0.3 or later to eliminate the arbitrary code execution risk.
Other vulnerabilities in Puma
See all- CVE-2024-45614Medium
Puma is a Ruby/Rack web server. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing an underscore version of the same header (X-Forwarded_For). v6.4.3/v5.6.9 now discard any headers using underscores if the non-underscore version also exists, so proxy-defined headers always win.
- CVE-2026-47737High
Puma versions 5.5.0 through 7.2.1 and 8.0.2 are vulnerable to source IP spoofing. When proxy_protocol: :v1 is enabled and persistent connections are used, Puma incorrectly re-parses PROXY headers after each keep-alive request, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR.
- CVE-2026-47736High
A vulnerability in Puma (versions 5.5.0 through 7.2.1 and 8.0.2) with PROXY protocol v1 support enabled allows an attacker to continuously send bytes without CRLF, causing unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer.
- CVE-2023-40175High
Puma, a Ruby/Rack web server, prior to versions 6.3.1 and 5.6.7, exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers, allowing for HTTP request smuggling.
Original NVD description (English source)
An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file
Vulnerability data from NVD (NIST) · CISA KEV · EPSS