CVE-2026-68006

A flaw was found in Puma. An attacker could exploit a vulnerability within the HTTP parser component to execute arbitrary code. This could allow the attacker to take control of the affected system.

An Important-impact flaw was found in the Puma Ruby web server, which Red Hat ships as rubygem-puma in Red Hat Satellite 6 and Fedora. Puma's HTTP request parser (ext/puma_http11/http11_parser.rl) mishandles header names containing underscore characters via the snake_upcase_char function in the C extension: a remote attacker, requiring no privileges or user interaction, can send headers that use underscores instead of hyphens (for example, Transfer_Encoding) to confuse Transfer-Encoding and Content-Length header processing and smuggle HTTP requests, with high impact to confidentiality and integrity (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This request-smuggling vector can lead to inconsistent interpretation of requests between Puma and front-end components. The pcs component in Red Hat Enterprise Linux, which bundles Puma, and the Red Hat Insights compliance-backend service are not affected because inline mitigations already exist in those offerings. For the affected rubygem-puma component in Red Hat Satellite 6, a fix is being pursued. Although the CVSS 3.1 base score assigned to this flaw is 9.1 (Critical), Red Hat rates its overall impact as Important.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.