{"id":"CVE-2026-68006","aliases":["DEBIAN-CVE-2026-68006","EUVD-2026-75664","GHSA-8vmp-v4pm-x3hq","UBUNTU-CVE-2026-68006"],"status":"published","title":"An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the...","description":"An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00526,"percentile":0.44843,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-444"],"published":"2026-09-10T00:00:00Z","modified":"2026-10-17T13:00:40Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.5-3","5.6.5-3+deb12u1","5.6.5-4","5.6.7-1","6.0.2-1","6.4.0-1","6.4.0-2","6.4.0-3","6.4.0-4","6.4.2-1","6.4.2-2","6.4.2-3","6.4.2-4","6.4.2-5","6.4.2-6","6.4.3-1","6.4.3-2","6.4.3-3","6.6.0-1","6.6.0-2","6.6.0-3","6.6.0-4","8.0.2-1","8.0.2-2","8.0.2-3"]},{"source":"osv","ecosystem":"Debian:13","package":"puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.6.0-4","8.0.2-1","8.0.2-2","8.0.2-3"]},{"source":"osv","ecosystem":"Debian:14","package":"puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.6.0-4","8.0.2-1","8.0.2-2","8.0.2-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.12.0-2ubuntu1","3.12.0-4ubuntu1","3.12.4-1ubuntu2","3.12.4-1ubuntu2+esm1","3.12.4-1ubuntu2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.6-1ubuntu4","5.5.2-2ubuntu2","5.5.2-2ubuntu2+esm1","5.5.2-2ubuntu2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.5-4ubuntu2","5.6.5-4ubuntu3","6.4.2-4ubuntu1","6.4.2-4ubuntu3","6.4.2-4ubuntu4","6.4.2-4ubuntu4.3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.6.0-4build1","8.0.2-3build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.6.0-4","6.6.0-4build1"]}],"references":[{"url":"https://github.com/czx1111/cve/issues/1"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68006"},{"url":"https://github.com/advisories/GHSA-8vmp-v4pm-x3hq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-68006","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-68006","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68006","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-68006","description":"An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file","status":"published","published":"2026-09-10T00:00:00Z","modified":"2026-09-14T18:14:32.955Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T13:45:59.110885Z"}],"euvd":[{"id":"EUVD-2026-75664","description":"An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file","status":"published","published":"2026-09-10T00:00:00Z","modified":"2026-09-14T18:14:32Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T17:28:19.730872Z"}],"ghsa":[{"id":"GHSA-8vmp-v4pm-x3hq","title":"An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the...","description":"An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file","status":"published","published":"2026-09-10T18:31:48Z","modified":"2026-09-14T21:31:25Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:11:52.325814Z"}],"nvd":[{"id":"CVE-2026-68006","description":"An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file","status":"published","published":"2026-09-10T18:18:04.96Z","modified":"2026-09-14T19:17:39.727Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:12:46.271848Z"}],"osv":[{"id":"DEBIAN-CVE-2026-68006","description":"An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file","status":"published","published":"2026-09-10T18:18:04.96Z","modified":"2026-10-01T03:03:49.045587145Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:46:01.68444Z"},{"id":"UBUNTU-CVE-2026-68006","description":"An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file","status":"published","published":"2026-09-10T18:18:00Z","modified":"2026-10-17T13:00:40.221135244Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:56:53.710209Z"}]}}