https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-45614.htmlhttps://patchthecve.com/cve/CVE-2024-45614.htmlWed, 17 Jun 2026 07:54:34 +0000MEDIUM 5.4: Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy set variables is affected. v6.4.3/v5.6.9 nohttps://patchthecve.com/cve/CVE-2024-21647.htmlhttps://patchthecve.com/cve/CVE-2024-21647.htmlWed, 17 Jun 2026 07:09:55 +0000MEDIUM 5.9: Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an attahttps://patchthecve.com/cve/CVE-2023-40175.htmlhttps://patchthecve.com/cve/CVE-2023-40175.htmlWed, 17 Jun 2026 06:16:33 +0000HIGH 7.3: Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is highly dependent on