CVE-2024-45614

mediumpriority · track · 32EPSS 0.006 · 50 %ileexploit · PoCDEEURUUS
grimoire priorityP1 · Urgent
Exploitable?
Public exploit
1 exploit · PoC
Likely / severe?
0.64% (50th) EPSS
CVSS 5.4 · medium
Is it mine?
18 products
Check your exposure
Who says so?
6 sources
cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · scored 2026-10-27

Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy set variables is affected. v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win. Users are advised to upgrade. Nginx has a underscores_in_headers configuration variable to discard these headers at the proxy level as a mitigation. Any users that are implicitly trusting the proxy defined headers for security should immediately cease doing so until upgraded to the fixed versions.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • Fixedruby4.0-rubygem-puma-0:6.4.3-1.5.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-puma-0:6.4.3-1.5.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-puma-0:6.4.3-1.5.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-puma-0:6.4.3-1.5.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

02

cvss

Technical severity, 0–10. One row per scoring source.

5.4
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.4mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 2.2 · impact 2.7
v3.15.4mediumAV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU
v3.15.4mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:Nsecondary · ENISA EU
v3.15.4mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:Nsecondary · security-advisories@github.comexploitability 2.2 · impact 2.7
v3.15.4mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:Nsecondary · OSV
v3.15.1mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:Psecondary · CVSS-BT (t0sche)
v3.15.4mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:Nsecondary · SUSE Product Security
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-444USprimaryCWE-444USCWE-444USCWE-639USCWE-639US
05

exploits (1)

Public proof-of-concept and weaponised exploit code.

06

affected products (18)

Products and version ranges known to be affected.

07

advisories (2)

Vendor and ecosystem advisories describing this.

  • openSUSE-SU-2026:10357-1ruby4.0-rubygem-puma-6.4.3-1.5 on GA media2026-03-13csaf · suse_csafDE

    ruby4.0-rubygem-puma-6.4.3-1.5 on GA media

  • GHSA-9hf4-67fc-4vf4Puma's header normalization allows for client to clobber proxy set headers2024-09-20ghsa · osvUS

    ### Impact Clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users trusting headers set by their proxy may be affected. Attackers may be able to downgrade connections to HTTP (non-SSL) or redirect responses, which could cause confidentiality leaks if combined with a separate MITM attack. ### Patches v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win. ### Workarounds Nginx has a [underscores_in_headers](https://nginx.org/en/docs/http/ngx_http_core_module.html#underscores_in_headers) configuration variable to discard these headers at the proxy level. Any users that are implicitly trusting the proxy defined headers for security or availability should immediately cease doing so until upgraded to the fixed versions.

08

also known as (4)

Other names and identifiers for this entity.

09

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bdunvdosvsuse_csafNVDCVE.orgMITRE
published 2024-09-19modified 2026-06-17
11

references (9)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan