Puma's header normalization allows for client to clobber proxy set headers

🗓️ 20 Sep 2024 14:40:16Reported by GitHub Advisory DatabaseType

Puma header normalization allows clients to clobber proxy set headers resulting in potential security vulnerabilities and confidentiality leaks if combined with MITM attack. Patch v6.4.3/v5.6.9 discards headers using underscores, allowing proxy defined headers to always win

Reporter	Title	Published	Views	Family All 67
IBM Security Bulletins	Security Bulletin: Vulnerability in Puma used by Logstash affect IBM Operations Analytics - Log Analysis (CVE-2024-45614)	25 Apr 202512:51	–	ibm
AstraLinux	Astra Linux - уязвимость в puma	20 May 202605:53	–	astralinux
Chainguard	CVE-2024-45614 vulnerabilities	19 Sep 202423:15	–	cgr
Circl	CVE-2024-45614	20 Sep 202402:11	–	circl
CNNVD	Puma 安全漏洞	19 Sep 202400:00	–	cnnvd
CVE	CVE-2024-45614	19 Sep 202422:42	–	cve
Cvelist	CVE-2024-45614 Header normalization allows for client to clobber proxy set headers in Puma	19 Sep 202422:42	–	cvelist
Debian	[SECURITY] [DLA 3947-1] puma security update	6 Nov 202415:58	–	debian
Debian CVE	CVE-2024-45614	19 Sep 202422:42	–	debiancve
Tenable Nessus	Debian dla-3947 : puma - security update	6 Nov 202400:00	–	nessus

Vulners

Node

puma pumaRange6.0.0–6.4.3rubygems

puma pumaRange<5.6.9rubygems

Source	Link
github	www.github.com/puma/puma/security/advisories/GHSA-9hf4-67fc-4vf4
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-45614
github	www.github.com/puma/puma/commit/cac3fd18cf29ed43719ff5d52d9cfec215f0a043
github	www.github.com/puma/puma/commit/f196b23be24712fb8fb16051cc124798cc84f70e
nginx	www.nginx.org/en/docs/http/ngx_http_core_module.html
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2024-45614.yml
lists	www.lists.debian.org/debian-lts-announce/2024/11/msg00004.html
github	www.github.com/advisories/GHSA-9hf4-67fc-4vf4

04 Nov 2025 16:53Current

7.1High risk

Vulners AI Score7.1

CVSS 3.15.4

EPSS0.00803

SSVC