Patchfirst
Patchfirst
ChainpumaRubyGems:puma

puma: successive fixes (2020–2024)

7 CVEs over 5 generations, 28 Feb 2020 to 8 Jan 2024.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2020-524728 Feb 2020 First in the chain
  2. CVE-2020-52492 Mar 2020 related to CVE-2020-5247
  3. CVE-2020-1107622 May 2020 next fix after CVE-2020-5249
  4. CVE-2021-4113612 Oct 2021 No direct link to an earlier CVE
  5. CVE-2022-2479030 Mar 2022 related to CVE-2020-5247related to CVE-2020-5249and 2 more
  6. CVE-2023-4017518 Aug 2023 related to CVE-2022-24790related to CVE-2020-11076
  7. CVE-2024-216478 Jan 2024 related to CVE-2023-40175related to CVE-2022-24790
Feb 2020AprJulJan 2021OctJan 2022AprOctJul 2023OctJan 2024 CVE-2020-5247 → CVE-2020-5249: related (high confidence)CVE-2022-24790 → CVE-2023-40175: related (high confidence)CVE-2023-40175 → CVE-2024-21647: related (high confidence)CVE-2020-5247 → CVE-2022-24790: related (medium confidence)CVE-2020-5249 → CVE-2022-24790: related (medium confidence)CVE-2020-11076 → CVE-2022-24790: related (medium confidence)CVE-2020-11076 → CVE-2023-40175: related (medium confidence)CVE-2021-41136 → CVE-2022-24790: related (medium confidence)CVE-2022-24790 → CVE-2024-21647: related (medium confidence)CVE-2020-5249 → CVE-2020-11076: Next fix in the same package (low confidence) CVE-2020-5247 28 Feb 2020 CVE-2020-5249 2 Mar 2020 CVE-2020-11076 22 May 2020 CVE-2021-41136 12 Oct 2021 CVE-2022-24790 30 Mar 2022 CVE-2023-40175 18 Aug 2023 CVE-2024-21647 8 Jan 2024 Feb 2020AprJulJan 2021OctJan 2022AprOctJul 2023OctJan 2024 CVE-2020-5247 → CVE-2020-5249: related (high confidence)CVE-2022-24790 → CVE-2023-40175: related (high confidence)CVE-2023-40175 → CVE-2024-21647: related (high confidence)CVE-2020-5247 → CVE-2022-24790: related (medium confidence)CVE-2020-5249 → CVE-2022-24790: related (medium confidence)CVE-2020-11076 → CVE-2022-24790: related (medium confidence)CVE-2020-11076 → CVE-2023-40175: related (medium confidence)CVE-2021-41136 → CVE-2022-24790: related (medium confidence)CVE-2022-24790 → CVE-2024-21647: related (medium confidence)CVE-2020-5249 → CVE-2020-11076: Next fix in the same package (low confidence) CVE-2020-5247 28 Feb 2020 CVE-2020-5249 2 Mar 2020 CVE-2020-11076 22 May 2020 CVE-2021-41136 12 Oct 2021 CVE-2022-24790 30 Mar 2022 CVE-2023-40175 18 Aug 2023 CVE-2024-21647 8 Jan 2024
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2020-5247 28 Feb 2020 HTTP Response Splitting in Puma · fixed in 4.3.3 First in chain 21.6
CVE-2020-5249 2 Mar 2020 HTTP Response Splitting (Early Hints) in Puma · fixed in 4.3.3 CVE-2020-5247 · related · High 19.6
CVE-2020-11076 22 May 2020 HTTP Smuggling via Transfer-Encoding Header in Puma · fixed in 4.3.4 CVE-2020-5249 · Next fix in the same package · Low 28.4
CVE-2021-41136 12 Oct 2021 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma · fixed in 5.5.1 First in chain 16.2
CVE-2022-24790 30 Mar 2022 HTTP Request Smuggling in puma · fixed in 5.6.4 CVE-2020-5247 · related · Medium 22.9
CVE-2023-40175 18 Aug 2023 Inconsistent Interpretation of HTTP Requests in puma · fixed in 6.3.1 CVE-2022-24790 · related · High 16.7
CVE-2024-21647 8 Jan 2024 HTTP Request/Response Smuggling in puma · fixed in 6.4.2 CVE-2023-40175 · related · High 16.4
↑ ↓ chooseEnter openEsc close