Medium severity · published Mar 2, 2020
CVE-2020-5249
In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the…
6.5
CVSS
1.6%
EPSS
No
On KEV
Description
In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS). This is related to CVE-2020-5247, which fixed this vulnerability but only for regular responses. This has been fixed in 4.3.3 and 3.12.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PU
Puma · Puma
through 3.12.3; 4.0.0 through 4.3.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-5249
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-5249
Patch
https://github.com/puma/puma/commit/c22712fc93284a45a93f9ad7023888f3a65524f3
Third Party Advisory
https://github.com/puma/puma/security/advisories/GHSA-33vf-4xgg-9r58
Third Party Advisory
https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMJ3CGZ3DLBJ5WUUKMI5ZFXFJQMXJZIK/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIHVO3CQMU7BZC7FCTSRJ33YDNS3GFPK/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ3LL5F5QADB6LM46GXZETREAKZMQNRD/
More from Puma
9.8
CVE-2023-40175
Puma is a Ruby/Rack web server built for parallelism
7.5
CVE-2026-47736
Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion
7.5
CVE-2026-47737
Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections
7.5
CVE-2024-21647
Puma is a web server for Ruby/Rack applications built for parallelism
7.5
CVE-2022-24790
Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications