CVE-2022-23634 - CVE House

Back to Database

Status published High CVE-2022-23634

Information Exposure when using Puma with Rails

8 CVSS

Vulnerability Description

Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-23634

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from puma

View All →

Header normalization allows for client to clobber proxy set headers in Puma

HTTP Request/Response Smuggling in puma

Inconsistent Interpretation of HTTP Requests in puma

HTTP Request Smuggling in puma

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma

Affected Vendor

puma

View all reports →

Affected Software

puma

Vulnerable Versions:

>= 5.0.0, < 5.6.2, < 4.3.11

Timeline

Official Publish: February 11th, 2022

Last Modified: April 23rd, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1213 Data from Information Repositories

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1041 Exfiltration Over C2 Channel