CVE-2023-40175
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
Puma, a Ruby/Rack web server, prior to versions 6.3.1 and 5.6.7, exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers, allowing for HTTP request smuggling.
Risk Assessment
The severity of this issue is highly dependent on the nature of the web site using Puma. This could lead to serious security issues, including unauthorized access to data.
Recommendation
It is recommended to upgrade to versions 6.3.1 or 5.6.7 to mitigate this vulnerability. There are no known workarounds for this issue.
Other vulnerabilities in Puma
See all- CVE-2026-47737High
Puma versions 5.5.0 through 7.2.1 and 8.0.2 are vulnerable to source IP spoofing. When proxy_protocol: :v1 is enabled and persistent connections are used, Puma incorrectly re-parses PROXY headers after each keep-alive request, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR.
- CVE-2026-47736High
A vulnerability in Puma (versions 5.5.0 through 7.2.1 and 8.0.2) with PROXY protocol v1 support enabled allows an attacker to continuously send bytes without CRLF, causing unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer.
Original NVD description (English source)
Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is highly dependent on the nature of the web site using puma is. This could be caused by either incorrect parsing of trailing fields in chunked transfer encoding bodies or by parsing of blank/zero-length Content-Length headers. Both issues have been addressed and this vulnerability has been fixed in versions 6.3.1 and 5.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.