GHSA-h99w-9q5r-gjq9 is a critical-severity (CVSS 9.1) CWE-444 vulnerability in puma. A fix is available for puma — see the affected versions and patch details below.
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-h99w-9q5r-gjq9.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
puma💎pumaReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.
Description
When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma.
The following vulnerabilities are addressed by this advisory:
- Lenient parsing of
Transfer-Encodingheaders, when unsupported encodings should be rejected and the final encoding must bechunked. - Lenient parsing of malformed
Content-Lengthheaders and chunk sizes, when only digits and hex digits should be allowed. - Lenient parsing of duplicate
Content-Lengthheaders, when they should be rejected. - Lenient parsing of the ending of chunked segments, when they should end with
\r\n.
The vulnerability has been fixed in 5.6.4 and 4.3.12. When deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard.
These proxy servers are known to have "good" behavior re: this standard and upgrading Puma may not be necessary. Users are encouraged to validate for themselves.
- Nginx (latest)
- Apache (latest)
- Haproxy 2.5+
- Caddy (latest)
- Traefik (latest)
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 💎RubyGems | puma | ≥ 5.0.0&&< 5.6.4 | 5.6.4bundle update puma --conservative |
| 💎RubyGems | puma | all versions | 4.3.12bundle update puma --conservative |
Affected Products
debian linuxdebianfedorafedoraprojectpumapumaDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for puma, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update puma to 5.6.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-h99w-9q5r-gjq9 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat Gluster Storage 3.5 for RHEL 7 | rubygem-puma-0:4.3.12-1.el7rhgs | RHSA-2023:1486 |
| Red Hat Satellite 6.9 for RHEL 7 | tfm-rubygem-puma-0:4.3.12-1.el7sat | RHSA-2022:8532 |
Frequently Asked Questions
Is GHSA-h99w-9q5r-gjq9 in your dependencies?
Find it across RubyGems, including transitive dependencies.