CVE-2024-21647 - CVE House
Back to Database
Status published Medium CVE-2024-21647

HTTP Request/Response Smuggling in puma

Vulnerability Description

Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. This vulnerability has been fixed in versions 6.4.2 and 5.6.8.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-21647

Credits & Attribution

No credits recorded in the NVD database.

References

More from puma

View All →
CVE-2024-45614
Header normalization allows for client to clobber proxy set headers in Puma
Medium 5.4
CVE-2023-40175
Inconsistent Interpretation of HTTP Requests in puma
High 7.3
CVE-2022-24790
HTTP Request Smuggling in puma
Critical 9.1
CVE-2022-23634
Information Exposure when using Puma with Rails
High 8
CVE-2021-41136
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma
Low 3.7

Affected Vendor

Affected Software

puma
Vulnerable Versions:
< 5.6.8, >= 6.0.0, < 6.4.2

Timeline

Official Publish: January 8th, 2024
Last Modified: November 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-444

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1565.002 Stored Data Manipulation
Impact
T1078 Valid Accounts
Defense Evasion