CVE-2026-68006
Description
A flaw was found in Puma. An attacker could exploit a vulnerability within the HTTP parser component to execute arbitrary code. This could allow the attacker to take control of the affected system.
Statement
An Important-impact flaw was found in the Puma Ruby web server, which Red Hat ships as rubygem-puma in Red Hat Satellite 6 and Fedora. Puma's HTTP request parser (ext/puma_http11/http11_parser.rl) mishandles header names containing underscore characters via the snake_upcase_char function in the C extension: a remote attacker, requiring no privileges or user interaction, can send headers that use underscores instead of hyphens (for example, Transfer_Encoding) to confuse Transfer-Encoding and Content-Length header processing and smuggle HTTP requests, with high impact to confidentiality and integrity (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This request-smuggling vector can lead to inconsistent interpretation of requests between Puma and front-end components. The pcs component in Red Hat Enterprise Linux, which bundles Puma, and the Red Hat Insights compliance-backend service are not affected because inline mitigations already exist in those offerings. For the affected rubygem-puma component in Red Hat Satellite 6, a fix is being pursued. Although the CVSS 3.1 base score assigned to this flaw is 9.1 (Critical), Red Hat rates its overall impact as Important.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 9.1 | N/A | 9.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
