CVE-2022-24790

Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The vulnerability has been fixed in 5.6.4 and 4.3.12. Users are advised to upgrade as soon as possible. Workaround: when deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard.

• CWE-444

• https://github.com/puma/puma/commit/5bb7d202e24dec00a898dca4aa11db391d7787a5Patch, Third Party Advisory
• https://github.com/puma/puma/security/advisories/GHSA-h99w-9q5r-gjq9Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/08/msg00015.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6YWGIIKL7KKTS3ZOAYMYPC7D6WQ5OA5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7NESIBFCNSR3XH7LXDPKVMSUBNUB43G/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TUBFJ44NCKJ34LECZRAP4N5VL6USJSIB/
• https://security.gentoo.org/glsa/202208-28Third Party Advisory
• https://www.debian.org/security/2022/dsa-5146Third Party Advisory
• https://github.com/puma/puma/commit/5bb7d202e24dec00a898dca4aa11db391d7787a5Patch, Third Party Advisory
• https://github.com/puma/puma/security/advisories/GHSA-h99w-9q5r-gjq9Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/08/msg00015.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6YWGIIKL7KKTS3ZOAYMYPC7D6WQ5OA5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7NESIBFCNSR3XH7LXDPKVMSUBNUB43G/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TUBFJ44NCKJ34LECZRAP4N5VL6USJSIB/
• https://security.gentoo.org/glsa/202208-28Third Party Advisory
• https://www.debian.org/security/2022/dsa-5146Third Party Advisory

Published

Mar 30, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24785Moment.js is a JavaScript date library for parsing, validati…7.5
• CVE-2022-24786PJSIP is a free and open source multimedia communication lib…9.8
• CVE-2022-24787Vyper is a Pythonic Smart Contract Language for the Ethereum…7.5
• CVE-2022-24788Vyper is a pythonic Smart Contract Language for the ethereum…9.8
• CVE-2022-24789C1 CMS is an open-source, .NET based Content Management Syst…7.6
• CVE-2022-2479Insufficient validation of untrusted input in File in Google…4.3
• CVE-2022-24791Wasmtime is a standalone JIT-style runtime for WebAssembly, …9.8
• CVE-2022-24792PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2022-24793PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2022-24794Express OpenID Connect is an Express JS middleware implement…6.1
• CVE-2022-24795yajl-ruby is a C binding to the YAJL JSON parsing and genera…7.5
• CVE-2022-24796RaspberryMatic is a free and open-source operating system fo…9.8