CVE-2024-45614

Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy set variables is affected. v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win. Users are advised to upgrade. Nginx has a underscores_in_headers configuration variable to discard these headers at the proxy level as a mitigation. Any users that are implicitly trusting the proxy defined headers for security should immediately cease doing so until upgraded to the fixed versions.

• CWE-639
• CWE-444

• https://github.com/puma/puma/security/advisories/GHSA-9hf4-67fc-4vf4Vendor Advisory
• https://nginx.org/en/docs/http/ngx_http_core_module.html#underscores_in_headersProduct
• https://lists.debian.org/debian-lts-announce/2024/11/msg00004.html

Published

Sep 19, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45609GLPI is a Free Asset and IT Management Software package, Dat…6.1
• CVE-2024-4561 In WhatsUp Gold versions released before 2023.1.2 , a bli…5.3
• CVE-2024-45610GLPI is an open-source asset and IT management software pack…6.1
• CVE-2024-45611GLPI is an open-source asset and IT management software pack…5.4
• CVE-2024-45612Contao is an Open Source CMS. In affected versions an untrus…5.3
• CVE-2024-45613CKEditor 5 is a JavaScript rich-text editor. Starting in ver…6.1
• CVE-2024-45615A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 m…3.9
• CVE-2024-45616A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 m…3.9
• CVE-2024-45617A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 m…3.9
• CVE-2024-45618A vulnerability was found in pkcs15-init in OpenSC. An attac…3.9
• CVE-2024-45619A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 m…4.3
• CVE-2024-4562 In WhatsUp Gold versions released before 2023.1.2 , an SS…5.4