Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Loading CVE intelligence

Loading vulnerability catalog

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

CVE-2024-45614

MediumPublished

Header normalization allows for client to clobber proxy set headers in Puma

Published: Sep 19, 2024
Updated: Nov 3, 2025
Assigning CNA: GitHub_M
Evidence observed: Aug 8, 2026

Primary CVSS

5.4/ 10Medium

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS probability estimate

0.6%

Low · next 30 days

Percentile: 48.9%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy set variables is affected. v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win. Users are advised to upgrade. Nginx has a underscores_in_headers configuration variable to discard these headers at the proxy level as a mitigation. Any users that are implicitly trusting the proxy defined headers for security should immediately cease doing so until upgraded to the fixed versions.

Sources

puma_header_normalization-CVE-2024-45614PoC
Puma Header normalization CVE-2024-45614 確認

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.