The vulnerability resides in Puma’s HTTP/1.1 parser within ext/puma_http11/http11_parser.rl. An attacker can forge a specially crafted request that exploits the parser’s logic, leading to arbitrary code execution on the host running Puma. This gives an attacker full control over the server process and can be used to launch additional attacks or exfiltrate data.

All installations of Puma Web Server with versions from 5.0.0 up to but not including 8.0.3 (i.e., 8.0.2 and earlier) are affected. The vulnerability is independent of the operating system and exists wherever Puma accepts HTTP traffic.

The flaw permits remote code execution over the network; the CVSS score of 9.1 marks it as critical, while the EPSS score of <1% indicates wild. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the vulnerability by sending a crafted HTTP/1.1 request to Puma, without any credentials, leveraging the parser flaw in ext/puma_http11/http11_parser.rl. The attack vector is purely network based, targeting the port Puma listens on.