{"action":"Upgrade puma to 4.3.9 or later.","affected":[{"fixed":"5.5.1","introduced":"5.0.0"},{"fixed":"4.3.9","introduced":"0"}],"component":"puma","cve_ids":["CVE-2021-41136"],"ecosystem":"RubyGems","epss":0.01203,"exploited":false,"fixed_versions":["5.5.1","4.3.9"],"ghsa_id":"GHSA-48w2-rm65-62xx","id":"tcs_01M5KEGJ3DFPCQP64Z1GAAWGFQ","modified_at":"2026-07-08T06:28:18.680516550Z","published_at":"2021-10-12T17:53:00Z","references":["https://osv.dev/vulnerability/GHSA-48w2-rm65-62xx","https://github.com/puma/puma/security/advisories/GHSA-48w2-rm65-62xx","https://nvd.nist.gov/vuln/detail/CVE-2021-41136","https://github.com/puma/puma/commit/436c71807f00e07070902a03f79fd3e130eb6b18","https://github.com/puma/puma/commit/acdc3ae571dfae0e045cf09a295280127db65c7f","https://github.com/puma/puma/commit/fb6ad8f8013ab5cdbb2f444cbfabd0b4fde71139","https://github.com/puma/puma","https://github.com/puma/puma/releases/tag/v4.3.9","https://github.com/puma/puma/releases/tag/v5.5.1","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2021-41136.yml","https://lists.debian.org/debian-lts-announce/2022/08/msg00015.html","https://security.gentoo.org/glsa/202208-28","https://www.debian.org/security/2022/dsa-5146"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-48w2-rm65-62xx","url":"https://osv.dev/vulnerability/GHSA-48w2-rm65-62xx"}],"summary":"Puma with proxy which forwards LF characters as line endings could allow HTTP request smuggling"}