Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Puma bug bounty programs

puma.io Updated

Puma runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
13
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Puma runs.

  • Puma

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

13 targets. 6 excluded.

  • https://puma.io

    Web

  • Cluster mode: the master process, worker forking, phased and hot restarts, and the socket-inheritance path across a restart

    Products and areas

  • HTTP request parsing in full: the request line, header names and values, chunked bodies, and the reconciliation of Content-Length against Transfer-Encoding

    Products and areas

  • Keep-alive handling and connection reuse, including any state that can carry from one request to the next

    Products and areas

  • PROXY protocol parsing, both v1 and v2, and the client address it produces

    Products and areas

  • Request body handling, including the temporary files used for large uploads

    Products and areas

  • Signal handling and the restart machinery, and what an unprivileged local user can do to a running server through it

    Products and areas

  • The control application and the token that authenticates it, which can restart or halt a running server

    Products and areas

  • The Rack environment Puma builds, and every header that reaches the application through it

    Products and areas

  • The reactor and thread pool, covering how a partially received request is buffered and at what point it is handed to a thread

    Products and areas

  • The SECURITY.md accepts reports through GitHub private vulnerability reporting or directly to the maintainer, and pins support to the latest 8.x and 7.x lines. It carves out no component of the server

    Products and areas

  • TLS termination through the MiniSSL binding, including certificate handling and the C extension underneath it

    Products and areas

  • UNIX socket and file-descriptor activation paths, and the permissions on anything Puma creates

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Denial of service that reduces to opening many connections with no amplification factor

  • Reports filed on the RubyGems HackerOne programme, which names Puma as out of scope

  • Ruby itself, OpenSSL and other upstream dependencies

  • The load balancer or reverse proxy in front, as a product; a disagreement between it and Puma is in scope on Puma's side

  • The Rails or Rack application Puma is serving

  • Versions outside the supported 7.x and 8.x lines

Recent changes

Reward and scope changes across every Puma program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Puma products, from the NVD.

Search NVD
  • CVE-2024-45614 Medium

    Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy set variables is affected. v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, all

  • CVE-2024-21647 Medium

    Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. This vulnerability has bee

  • CVE-2023-40175 High

    Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is highly dependent on the nature of the web site using puma is. This could be caused by either incorrect parsing of traili

  • CVE-2022-24790 Critical

    Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The vulnerability has been fixed

  • CVE-2022-23634 High

    Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes

  • CVE-2021-41136 Low

    Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. The only proxy which has this behavior, as far as the Puma team

  • CVE-2021-29509 High

    Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all th

  • CVE-2020-11077 Medium

    In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request

About this page

This page gathers every public program listed under puma.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.