CVE-2024-21647

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. This vulnerability has been fixed in versions 6.4.2 and 5.6.8.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-444

Affected software

No affected versions have been published.

Timeline

Published: Jan 8, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-216488.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The rollback action is missing a ri CVE-2024-216498.8The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation CVE-2024-21655.4The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt parameter in all versions up CVE-2024-216509.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to a remote cod CVE-2024-216516.5XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user able to attach a file to a p CVE-2024-216529.8Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can explo CVE-2024-216539.8The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation CVE-2024-216549.8Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeo CVE-2024-216554.3Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malici CVE-2024-216584.3discourse-calendar is a discourse plugin which adds the ability to create a dynamic calendar in the first post of a topic. The limit on regi CVE-2024-21666.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Email Security (Real Time M CVE-2024-216617.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can explo