Threats tagged 'ghsa-8vmp-v4pm-x3hq'

A critical remote code execution vulnerability (CVE-2026-68006) exists in Puma web server versions from 5.0.0 up to but not including 8.0.3. The flaw is located in the ext/puma_http11/http11_parser.rl file and allows unauthenticated attackers to execute arbitrary code remotely. The vulnerability has a high CVSS score of 9.1, indicating severe impact on confidentiality and integrity without requiring user interaction or privileges.