CVE-2024-21647

RubyGems/puma CVE-2024-21647: medium 5.9

Puma HTTP Request/Response Smuggling vulnerability

Action: Upgrade puma to 5.6.8 or later.

bundle update puma

Affected

Fixed versions

Sources

• osv: GHSA-c2f4-cvqm-65w2
• https://github.com/puma/puma/security/advisories/GHSA-c2f4-cvqm-65w2
• https://nvd.nist.gov/vuln/detail/CVE-2024-21647
• https://github.com/puma/puma/commit/5fc43d73b6ff193325e657a24ed76dec79133e93
• https://github.com/puma/puma/commit/60d5ee3734adc8cee85c3f0561af392448fe19b7
• https://github.com/puma/puma/commit/bbb880ffb6debbfdea535b4b3eb2204d49ae151d
• https://github.com/puma/puma
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2024-21647.yml
• https://lists.debian.org/debian-lts-announce/2024/11/msg00004.html

CVE-2024-21647 · published 2024-01-08T15:56:48Z · modified 2026-09-10T03:49:24.667590732Z · JSON