CVE-2026-68006 (Critical) detected in puma-8.0.1.gem

Nobody has claimed this yet.

## CVE-2026-68006 - Critical Severity Vulnerability
Vulnerable Library - puma-8.0.1.gem

Puma is a simple, fast, multi-threaded, and highly parallel HTTP 1.1 server
for Ruby/Rack applications. Puma is intended for use in both development and
production environments. It's great for highly parallel Ruby implementations such as
JRuby and TruffleRuby as well as as providing process worker support to support CRuby well.

Library home page: https://rubygems.org/gems/puma-8.0.1.gem

Sample Path to Dependency File: /Gemfile.lock

Path to vulnerable library: /tmp/containerbase/cache/.ruby/cache/puma-8.0.1.gem

Dependency Hierarchy:
- :x: **puma-8.0.1.gem** (Vulnerable Library)

Found in base branch: master

Vulnerability Details

An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file

Publish Date: 2026-09-10

URL: CVE-2026-68006

CVSS 3 Score Details (9.1)

Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None

For more information on CVSS3 Scores, click here.

***
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)

Open Gemfile.lock and inspect the puma entry, then compare its version with the affected range described in the issue. Update the locked dependency to a release outside that range and run the project's dependency or security check to confirm CVE-2026-68006 is no longer reported.

Written by the indexing model from the issue text.