9.1

CVE-2022-24790: HTTP Request Smuggling in puma

Modified
AliasesSUSE-SU-2022:3571-1RHSA-2022:8532UBUNTU-CVE-2022-24790
Published 30-03-2022Last modified 23-04-2025

Vulnerability summary

CVE-2022-24790 is a critical (CVSS 9.1) vulnerability in debian debian_linux. EPSS estimates a 2.19% chance of exploitation in the next 30 days, higher than 82.4% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 9.1 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 2% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
9.1/10
010
Critical · v3.1 (CVE.org)
EPSS score
2.19%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 9 · Related 6
DLA-3083-1DSA-5146-1OPENSUSE-SU-2024:12592-1OPENSUSE-SU-2024:13166-1OPENSUSE-SU-2024:13721-1RHSA-2023:1486

Timeline

  1. 30-03-2022
    PublishedVulnerability first disclosed.
  2. 23-04-2025
    Last modifiedVulnerability information updated.

Description

Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The vulnerability has been fixed in 5.6.4 and 4.3.12. Users are advised to upgrade as soon as possible. Workaround: when deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard.

CVSS metrics

7 scores · 6 sources · 2 versions

EPSS trend

Probability

2.19%

Chance of exploitation in the next 30 days

Percentile

82%

Versus all other CVEs

30-day change

No change 0.00 pp

From 2.19% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse5 products
  • rubygem-puma&distro=SUSE Linux Enterprise High Availability Extension 15< 4.3.12-150000.3.9.1
  • rubygem-puma&distro=SUSE Linux Enterprise High Availability Extension 15 SP1< 4.3.12-150000.3.9.1
  • rubygem-puma&distro=SUSE Linux Enterprise High Availability Extension 15 SP2< 4.3.12-150000.3.9.1
  • rubygem-puma&distro=SUSE Linux Enterprise High Availability Extension 15 SP3< 4.3.12-150000.3.9.1
  • rubygem-puma&distro=SUSE Linux Enterprise High Availability Extension 15 SP4< 4.3.12-150000.3.9.1
Opensuse3 products
  • rubygem-puma-4&distro=openSUSE Tumbleweed< 4.3.12-1.1
  • rubygem-puma&distro=openSUSE Leap 15.3< 4.3.12-150000.3.9.1
  • rubygem-puma&distro=openSUSE Leap 15.4< 4.3.12-150000.3.9.1
Debian2 products
Redhat2 products
  • tfm-rubygem-puma< 0:4.3.12-1.el7sat
  • tfm-rubygem-puma-debuginfo< 0:4.3.12-1.el7sat
Fedoraproject1 product
Puma1 product
  • puma< 4.3.12 | ≥ 5.0.0, < 5.6.4
RubyGems1 product
  • puma≥ 5.0.0, < 5.6.4 | < 4.3.12
Ubuntu1 product
  • puma< 3.12.4-1ubuntu2+esm1 | < 5.5.2-2ubuntu2+esm1

8 vendors · 16 products

References

34 links
Show all 34 references