Puma vulnerabilities

Puma is a Ruby/Rack web server. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing an underscore version of the same header (X-Forwarded_For). v6.4.3/v5.6.9 now discard any headers using underscores if the non-underscore version also exists, so proxy-defined headers always win.

An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file.

Puma versions 5.5.0 through 7.2.1 and 8.0.2 are vulnerable to source IP spoofing. When proxy_protocol: :v1 is enabled and persistent connections are used, Puma incorrectly re-parses PROXY headers after each keep-alive request, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR.

A vulnerability in Puma (versions 5.5.0 through 7.2.1 and 8.0.2) with PROXY protocol v1 support enabled allows an attacker to continuously send bytes without CRLF, causing unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer.

Puma, a Ruby/Rack web server, prior to versions 6.3.1 and 5.6.7, exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers, allowing for HTTP request smuggling.