CVE-2026-68006

Awaiting Analysis Awaiting Analysis - Queue

Remote Code Execution in Puma Web Server

Publication date: 2026-09-10

Last updated on: 2026-09-14

Assigner: MITRE

Description

An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-14

Generated

2026-10-01

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-68006

EUVD

EUVD-2026-75664

Affected Vendors & Products

Vendor	Product	Version / Range
puma	puma	From 3.12.6 (inc) to 8.0.2 (inc)
puma	puma	5.0.0
puma	puma	to 8.0.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

CVE-2026-68006 is an HTTP Request Smuggling vulnerability in Puma, a Ruby web server. It occurs because Puma converts underscores in header names to commas, creating mismatches between how front-end proxies and Puma interpret requests. Attackers exploit this by sending headers like Transfer_Encoding or Content_Length, causing Puma to misread request boundaries and enabling attacks such as web cache poisoning or session hijacking.

Detection Guidance

To detect this vulnerability, inspect HTTP requests for underscore headers like Transfer_Encoding or Content_Length. Use tools like tcpdump or Wireshark to capture and analyze traffic for non-standard header formats. Check proxy logs for inconsistencies between front-end and backend server interpretations of headers.

Impact Analysis

This vulnerability can lead to serious security issues like web cache poisoning, access control bypass, session hijacking, and sensitive data disclosure. Attackers may manipulate requests to bypass security controls or steal user sessions by exploiting how Puma processes malformed headers.

Compliance Impact

This vulnerability could lead to sensitive information disclosure, session hijacking, and access control bypass, which are direct violations of GDPR's data protection requirements and HIPAA's safeguards for protected health information. Exploitation may result in unauthorized access to personal or medical data, triggering non-compliance with these regulations.

Mitigation Strategies

Upgrade Puma to version 8.0.3 or later. Configure front-end proxies to reject requests with underscore headers. Implement input validation to block headers containing underscores. Review and update request parsing logic to handle comma-separated keys correctly.

Hi! I’m here to help you understand CVE-2026-68006. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70