{"action":"Upgrade puma to 4.3.12 or later.","affected":[{"fixed":"5.6.4","introduced":"5.0.0"},{"fixed":"4.3.12","introduced":"0"}],"component":"puma","cve_ids":["CVE-2022-24790"],"ecosystem":"RubyGems","epss":0.02191,"exploited":false,"fixed_versions":["5.6.4","4.3.12"],"ghsa_id":"GHSA-h99w-9q5r-gjq9","id":"tcs_01M5KEKJR81Y9315V0S6YYQS75","modified_at":"2024-02-16T07:55:51.665412Z","published_at":"2022-03-30T21:48:50Z","references":["https://osv.dev/vulnerability/GHSA-h99w-9q5r-gjq9","https://github.com/puma/puma/security/advisories/GHSA-h99w-9q5r-gjq9","https://nvd.nist.gov/vuln/detail/CVE-2022-24790","https://github.com/puma/puma/commit/5bb7d202e24dec00a898dca4aa11db391d7787a5","https://github.com/puma/puma","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2022-24790.yml","https://lists.debian.org/debian-lts-announce/2022/08/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F6YWGIIKL7KKTS3ZOAYMYPC7D6WQ5OA5","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7NESIBFCNSR3XH7LXDPKVMSUBNUB43G","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TUBFJ44NCKJ34LECZRAP4N5VL6USJSIB","https://portswigger.net/web-security/request-smuggling","https://security.gentoo.org/glsa/202208-28","https://www.debian.org/security/2022/dsa-5146"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-h99w-9q5r-gjq9","url":"https://osv.dev/vulnerability/GHSA-h99w-9q5r-gjq9"}],"summary":"Puma vulnerable to HTTP Request Smuggling"}