564 matches found
serverless-prey
Puma Security Serverless Prey Serverless Prey is a collection of serverless functions FaaS, that, once launched to a cloud environment and invoked, establish a TCP reverse shell, enabling the user to introspect the underlying container: Panther: AWS Lambda written in Node.js Cougar: Azure Functio...
Puma6Fail
Puma 6 fail demo mackey가 발견한 이 게시물의 문제를 시연하는 도구: https://www.dslreports.com/forum/r31377755- 개념 증명 코드는 이미 공개되어 있습니다. CVE-2017-5693를 참조하세요. DoS는 어느 방향으로든 발생합니다 - LAN에서 WAN으로 또는 WAN에서 LAN으로의 UDP. 로컬 Virgin Media Super Hub 3 모뎀을 통한 테스트: root@kitploit: 1mbps/2000pps 20ms 평균 지연 시간 증가최대 200 발생...
CVE-2026-68006
An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/pumahttp11/http11parser.rl file...
EUVD-2026-75664
An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/pumahttp11/http11parser.rl file...
CVE-2026-68006
Puma (a Ruby application server) versions v.5.0.0 through before v.8.0.3 are affected by an issue in the ext/puma_http11/http11_parser.rl file that allows an attacker to execute arbitrary code . The fix is to upgrade to v.8.0.3 or later. No exploitation status or active in-the-wild usage is provi...
CVE-2026-68006
An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/pumahttp11/http11parser.rl file...
puma_header_normalization-CVE-2024-45614
Puma Header normalization CVE-2024-45614 подтверждение advisory: https://github.com/puma/puma/security/advisories/GHSA-9hf4-67fc-4vf4 коммит с исправлением: https://github.com/puma/puma/commit/cac3fd18cf29ed43719ff5d52d9cfec215f0a043 Результаты Результаты выполнения request.rb duplicate...
Astra Linux – Vulnerability in Puma
Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, Puma exhibited incorrect behavior when parsing chunked transfer encoding bodies, allowing HTTP request smuggling. The fixed versions limit the size of chunk extensions. Without this limitation, an...
Astra Linux – Vulnerability in Puma
Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP requests comply with the RFC7230 standard, Puma and the frontend proxy may disagree about where the requests start and...
Astra Linux – Vulnerability in Puma
Puma is an HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted; it did not prevent new connections from being blocked by greedy persistent-connections that saturated all threads ...
Astra Linux – Vulnerability in Puma
Puma is a Ruby/Rack web server designed for parallelism. Prior to versions 6.3.1 and 5.6.7, Puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers, which could allow HTTP request smuggling. The severity of this issue depends heavily ...
Astra Linux – Vulnerability in Puma
Puma is an HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using “puma” with a proxy that forwards HTTP header values containing the LF character could lead to HTTP request smuggling. A client could secretly send a request through a proxy, causing the proxy to send ...
Astra Linux – Vulnerability in Puma
Puma is a Ruby/Rack web server designed for parallelism. Prior to version 5.6.2 of Puma, Puma might not always call close on the response body. Before version 7.0.2.2 of Rails, Rails relied on the response body being closed in order for its CurrentAttributes implementation to work correctly. The...
CVE-2026-59825 Mastodon: Unwanted deactivation of SSL/TLS certificate verification
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldapauthenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULTPARAMS when LDAP authentication uses LDAPTLSNOVERIFY=true, disabling SSL and T...
EUVD-2026-60953
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldapauthenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULTPARAMS when LDAP authentication uses LDAPTLSNOVERIFY=true, disabling SSL and T...
CVE-2026-59825 Mastodon: Unwanted deactivation of SSL/TLS certificate verification
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldapauthenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULTPARAMS when LDAP authentication uses LDAPTLSNOVERIFY=true, disabling SSL and T...
PT-2026-77143
Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.4.19 Mastodon versions 4.5.0 through 4.5.11 Description When LDAP authentication is configured with LDAP TLS NO VERIFY=true, the file app/models/concerns/user/ldap authenticable.rb mutates...
Linux Distros Unpatched Vulnerability : CVE-2026-47737
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when setremoteaddress...
Linux Distros Unpatched Vulnerability : CVE-2026-47736
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes int...
CVE-2026-47736
A flaw was found in Puma, a Ruby/Rack web server. When PROXY protocol v1 support is enabled, a remote attacker can continuously send data without proper termination. This causes the server to consume an increasing amount of memory and CPU resources, leading to a Denial of Service DoS where the...