CVE-2022-24790

Name: CVE-2022-24790
Creator: NVD / NIST
Published: 2022-03-30T22:15:08.5+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.5/10EPSS 2.14%

Last modified Jun 17, 2026

CVE-2022-24790 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. EPSS estimates a 2.14% chance of exploitation in the next 30 days.

Description

Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The vulnerability has been fixed in 5.6.4 and 4.3.12. Users are advised to upgrade as soon as possible. Workaround: when deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Probability

2.14%

79.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-444

Affected Software

Vendor	Product	Versions
Puma	Puma	< 4.3.12
Puma	Puma	>= 5.0.0, < 5.6.4
Debian	Debian Linux	10.0
Debian	Debian Linux	11.0
Fedoraproject	Fedora	35
Fedoraproject	Fedora	36
Fedoraproject	Fedora	37

References

https://github.com/puma/puma/commit/5bb7d202e24dec00a898dca4aa11db391d7787a5Patch, Third Party Advisory
https://github.com/puma/puma/security/advisories/GHSA-h99w-9q5r-gjq9Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/08/msg00015.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6YWGIIKL7KKTS3ZOAYMYPC7D6WQ5OA5/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7NESIBFCNSR3XH7LXDPKVMSUBNUB43G/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TUBFJ44NCKJ34LECZRAP4N5VL6USJSIB/
https://security.gentoo.org/glsa/202208-28Third Party Advisory
https://www.debian.org/security/2022/dsa-5146Third Party Advisory
https://github.com/puma/puma/commit/5bb7d202e24dec00a898dca4aa11db391d7787a5Patch, Third Party Advisory
https://github.com/puma/puma/security/advisories/GHSA-h99w-9q5r-gjq9Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/08/msg00015.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6YWGIIKL7KKTS3ZOAYMYPC7D6WQ5OA5/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7NESIBFCNSR3XH7LXDPKVMSUBNUB43G/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TUBFJ44NCKJ34LECZRAP4N5VL6USJSIB/
https://security.gentoo.org/glsa/202208-28Third Party Advisory
https://www.debian.org/security/2022/dsa-5146Third Party Advisory

Timeline

Published: Mar 30, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2022-24790?

How severe is CVE-2022-24790?

CVE-2022-24790 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 2.14% probability of exploitation in the next 30 days.

How do I fix CVE-2022-24790?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-24790?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST