- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 13
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 6 excluded.
Web 1
- https://puma.io
Products and areas 12
- Cluster mode: the master process, worker forking, phased and hot restarts, and the socket-inheritance path across a restart
- HTTP request parsing in full: the request line, header names and values, chunked bodies, and the reconciliation of Content-Length against Transfer-Encoding
- Keep-alive handling and connection reuse, including any state that can carry from one request to the next
- PROXY protocol parsing, both v1 and v2, and the client address it produces
- Request body handling, including the temporary files used for large uploads
- Signal handling and the restart machinery, and what an unprivileged local user can do to a running server through it
- The control application and the token that authenticates it, which can restart or halt a running server
- The Rack environment Puma builds, and every header that reaches the application through it
- The reactor and thread pool, covering how a partially received request is buffered and at what point it is handed to a thread
- The SECURITY.md accepts reports through GitHub private vulnerability reporting or directly to the maintainer, and pins support to the latest 8.x and 7.x lines. It carves out no component of the server
- TLS termination through the MiniSSL binding, including certificate handling and the C extension underneath it
- UNIX socket and file-descriptor activation paths, and the permissions on anything Puma creates
Out of scope (6)
- Denial of service that reduces to opening many connections with no amplification factor
- Reports filed on the RubyGems HackerOne programme, which names Puma as out of scope
- Ruby itself, OpenSSL and other upstream dependencies
- The load balancer or reverse proxy in front, as a product; a disagreement between it and Puma is in scope on Puma's side
- The Rails or Rack application Puma is serving
- Versions outside the supported 7.x and 8.x lines
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Report through GitHub private vulnerability reporting on puma/puma .
-
Test against a supported line. The policy supports the latest 8.x and 7.x releases
-
Send raw bytes for anything in the request path. A Ruby-level reproduction script hides the framing the finding actually depends on
-
Say which mode the server ran in, single or clustered with workers, and whether the thread pool was tuned away from defaults, since the failure surface differs
-
Do not file on the RubyGems HackerOne programme. It names Puma as out of scope and states it no longer pays monetary rewards, so a report there goes nowhere
Not accepted
-
Denial of service that reduces to opening many connections with no amplification factor
-
Versions outside the supported 7.x and 8.x lines
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2024-45614 | Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy set variables is affected. v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, all | Medium 5.4 | 19 Sep 2024 |
| CVE-2024-21647 | Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. This vulnerability has bee | Medium 5.9 | 8 Jan 2024 |
| CVE-2023-40175 | Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is highly dependent on the nature of the web site using puma is. This could be caused by either incorrect parsing of traili | High 7.3 | 18 Aug 2023 |
| CVE-2022-24790 | Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The vulnerability has been fixed | Critical 9.1 | 30 Mar 2022 |
| CVE-2022-23634 | Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes | High 8.0 | 11 Feb 2022 |
| CVE-2021-41136 | Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. The only proxy which has this behavior, as far as the Puma team | Low 3.7 | 12 Oct 2021 |
| CVE-2021-29509 | Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all th | High 7.5 | 11 May 2021 |
| CVE-2020-11077 | In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request | Medium 6.8 | 22 May 2020 |
| CVE-2020-11076 | In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4. | High 7.5 | 22 May 2020 |
| CVE-2020-5249 | In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response splitting is a vector for | Medium 6.5 | 2 Mar 2020 |
| CVE-2020-5247 | In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. `CR`, `LF` or`/r`, `/n`) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response s | Medium 6.5 | 28 Feb 2020 |
| CVE-2019-16770 | In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough. This vulnerability is patched in Puma 4.3.1 and 3.12.2. | Medium 5.3 | 5 Dec 2019 |
| CVE-2017-8943 | The PUMA PUMATRAC app 3.0.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. | Medium 5.9 | 15 May 2017 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 2 Last 12 months Parsing/validation 45 % Denial of service 25 % Access control 20 % Request smuggling 10 % Latest advisories Loading the feed Overview Puma is the HTTP server every Rails application ships with, the default since Rails 5 and the process that actually holds the socket for a very large share of production Ruby. It nearly always runs behind a load balancer, so what it believes about a request is what the application believes. CVE-2026-47737 is the reference point: repeated PROXY protocol v1 headers let a client choose the source IP Puma reported, and an application that authorises or rate-limits on that address was reading an attacker's value. RubyGems names Puma as out of scope for its programme and no longer pays for reports at all. sorona.xyz pays you directly on qualified, reproduced findings. In scope The SECURITY.md accepts reports through GitHub private vulnerability reporting or directly to the maintainer, and pins support to the latest 8.x and 7.x lines. It carves out no component of the server HTTP request parsing in full: the request line, header names and values, chunked bodies, and the reconciliation of Content-Length against Transfer-Encoding PROXY protocol parsing, both v1 and v2, and the client address it produces The Rack environment Puma builds, and every header that reaches the application through it The reactor and thread pool, covering how a partially received request is buffered and at what point it is handed to a thread Cluster mode: the master process, worker forking, phased and hot restarts, and the socket-inheritance path across a restart The control application and the token that authenticates it, which can restart or halt a running server TLS termination through the MiniSSL binding, including certificate handling and the C extension underneath it UNIX socket and file-descriptor activation paths, and the permissions on anything Puma creates Keep-alive handling and connection reuse, including any state that can carry from one request to the next Request body handling, including the temporary files used for large uploads Signal handling and the restart machinery, and what an unprivileged local user can do to a running server through it Out of scope The Rails or Rack application Puma is serving The load balancer or reverse proxy in front, as a product; a disagreement between it and Puma is in scope on Puma's side Ruby itself, OpenSSL and other upstream dependencies Versions outside the supported 7.x and 8.x lines Denial of service that reduces to opening many connections with no amplification factor Reports filed on the RubyGems HackerOne programme, which names Puma as out of scope Most-valued findings PROXY protocol parsing, v1 and v2 alike. Both 2026 advisories landed there, and its output is an address the application trusts for authorisation, rate limiting, geofencing and audit logs Anything that lets a client control the source address, the host or a forwarded header that the Rails application then treats as trustworthy, the CVE-2026-47737 shape Request smuggling or desync between Puma and a front end, whether through chunked encoding, duplicated framing headers or a keep-alive boundary Unbounded memory growth driven by a single connection, the class CVE-2026-47736 landed in. A Puma process serves many requests concurrently and takes all of them down with it State that survives from one request to the next on a reused connection or a reused thread, since Rack applications assume a clean environment every time The control application and its token, which is an authentication boundary sitting on a socket that can stop the server Anything reachable during a phased restart, where two generations of workers hold the same socket at once Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through GitHub private vulnerability reporting on puma/puma . The SECURITY.md says to report on GitHub or contact Evan Phoenix, and private reporting is enabled Test against a supported line. The policy supports the latest 8.x and 7.x releases Both 2026 advisories were in PROXY protocol v1 parsing, so state whether that support was enabled and exactly what your front end emits Send raw bytes for anything in the request path. A Ruby-level reproduction script hides the framing the finding actually depends on Say which mode the server ran in, single or clustered with workers, and whether the thread pool was tuned away from defaults, since the failure surface differs Do not file on the RubyGems HackerOne programme. It names Puma as out of scope and states it no longer pays monetary rewards, so a report there goes nowhere Disclosure Coordinated through GitHub private vulnerability reporting with a small maintainer group, published as a GitHub Security Advisory and mirrored into the rubysec advisory database, which is what the Ruby ecosystem's tooling actually reads. The May 2026 pair shipped together with fixes on both supported lines, in 7.2.1 and 8.0.2, so expect the advisory to land alongside patched releases for every supported branch at once. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability