The vulnerability resides in Puma’s HTTP/1.1 parser within ext/puma_http11/http11_parser.rl. An attacker can forge a specially crafted request that exploits the parser’s logic, leading to arbitrary code execution on the host running Puma. This gives an attacker full control over the server process and can be used to launch additional attacks or exfiltrate data.

All installations of Puma Web Server with versions from 5.0.0 up to but not including 8.0.3 (i.e., 8.0.2 and earlier) are affected. The vulnerability is independent of the operating system and exists wherever Puma accepts HTTP traffic.

The flaw permits remote code execution via network traffic; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability can be exploited by sending malicious HTTP requests to the Puma server. No privileged credentials are required; the attack vector is purely network based, targeting the port Puma listens on.