CVE-2026-68006

Puma, the Ruby web server that ships as the default application server for Ruby on Rails, contains a critical flaw (CWE-444, inconsistent interpretation of HTTP requests) in its HTTP/1.1 parser source file ext/puma_http11/http11_parser.rl, affecting versions from 5.0.0 up to before 8.0.3. An unauthenticated remote attacker can send specially crafted HTTP requests that Puma interprets differently than front-end proxies and load balancers, enabling request smuggling that the advisory states can be leveraged for arbitrary code execution. Successful exploitation yields high confidentiality and integrity impact with no privileges and no user interaction required (CVSS 9.1). Any application or API served by an affected Puma version is at risk, and deployments behind reverse proxies or load balancers (nginx, HAProxy, cloud/CDN fronts) are particularly exposed because smuggling exploits parsing mismatches between the proxy and the back end. No public proof of concept or confirmed in-the-wild exploitation is known, and the CVE is not on the CISA Known Exploited Vulnerabilities list.

What to do: Upgrade Puma to 8.0.3 or later immediately — check Gemfile.lock for the pinned puma version and redeploy. Until patched, review reverse-proxy/CDN/load-balancer configurations for HTTP request smuggling vectors (inconsistent handling of Content-Length and Transfer-Encoding) since the flaw lives in Puma's HTTP request parser. Review access logs for malformed or anomalous HTTP requests hitting Puma-backed applications if you were running an affected version.