CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVE-2020-11076
High (7.5). EPSS 4.1% chance of exploitation in the next 30 days. Fixed in puma 3.12.5, 4.3.4.
In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.
Severity
- EPSS
- 4.1% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
- CWE
- CWE-444
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- fedoraproject:fedora
- puma:puma
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-x7jg-6pwg-fx5h | RubyGems | puma | <3.12.5 | 3.12.5 |
| GHSA-x7jg-6pwg-fx5h | RubyGems | puma | >=4.0.0 <4.3.4 | 4.3.4 |
References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00034.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00038.html
- https://github.com/puma/puma/blob/master/History.md#434435-and-31253126--2020-05-22
- https://github.com/puma/puma/commit/f24d5521295a2152c286abb0a45a1e1e2bd275bd
- https://github.com/puma/puma/security/advisories/GHSA-x7jg-6pwg-fx5h