HTTP Response Splitting (Early Hints) in Puma
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 3 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS). This is related to CVE-2020-5247, which fixed this vulnerability but only for regular responses. This has been fixed in 4.3.3 and 3.12.4.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| puma | Puma | before 3.12.4; 4.0.0 to before 4.3.3 | 3.12.4, 4.3.3 | Patch available | CNA |
| — | puma (RubyGems) | before 3.12.4 | 3.12.4 | Patch available | GHSA-33vf-4xgg-9r58 |
| — | puma (RubyGems) | 4.0.0 to before 4.3.3 | 4.3.3 | Patch available | GHSA-33vf-4xgg-9r58 |
- Puma Vendorpuma Affected before 3.12.4; 4.0.0 to before 4.3.3 Fixed in 3.12.4, 4.3.3 Patch available CNA
- puma (RubyGems) Vendor— Affected before 3.12.4 Fixed in 3.12.4 Patch available GHSA-33vf-4xgg-9r58
- puma (RubyGems) Vendor— Affected 4.0.0 to before 4.3.3 Fixed in 4.3.3 Patch available GHSA-33vf-4xgg-9r58
Remediation
- Fix · CNA Puma (puma) Fixed in 3.12.4, 4.3.3
- Fix · GHSA-33vf-4xgg-9r58 puma (RubyGems) Fixed in 3.12.4 Advisory →
- Fix · GHSA-33vf-4xgg-9r58 puma (RubyGems) Fixed in 4.3.3 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Puma — FEDORA-2020-fd87f90634
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2020-04303 HTTP Response Splitting in PumaPriority LOW 38
- Advisory ·
Puma — FEDORA-2020-08092b4c97
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2020-04303 HTTP Response Splitting in PumaPriority LOW 38
Show 1 more group
- Advisory ·
Puma — FEDORA-2020-a3f26a9387
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2020-04303 HTTP Response Splitting in PumaPriority LOW 38
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| CloudForms Management Engine 5 | Affected | No fix planned: Will not fix |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2020-5249
- 2026-10-03 Alias added: GHSA-33vf-4xgg-9r58
References
Advisory 7
- https://owasp.org/www-community/attacks/HTTP_Response_Splitting
- https://github.com/puma/puma/security/advisories/GHSA-33vf-4xgg-9r58
- https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v
- FEDORA-2020-a3f26a9387
- FEDORA-2020-fd87f90634
- FEDORA-2020-08092b4c97
- https://nvd.nist.gov/vuln/detail/CVE-2020-5249
Other 5
- https://github.com/puma/puma
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2020-5249.yml
- https://lists.fedoraproject.org/archives/list/[email protected]/message/BMJ3CGZ3DLBJ5WUUKMI5ZFXFJQMXJZIK
- https://lists.fedoraproject.org/archives/list/[email protected]/message/DIHVO3CQMU7BZC7FCTSRJ33YDNS3GFPK
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NJ3LL5F5QADB6LM46GXZETREAKZMQNRD
More Puma vulnerabilities
- TI-2022-08603 HTTP Request Smuggling in puma CVSS 3.1CRITICAL 9.1
- TI-2023-21048 Inconsistent Interpretation of HTTP Requests in puma CVSS 3.1CRITICAL 9.8
- TI-2022-07686 Information Exposure when using Puma with Rails CVSS 3.1HIGH 8.0
- TI-2020-08950 HTTP Smuggling via Transfer-Encoding Header in Puma CVSS 3.1HIGH 7.5
- TI-2020-08951 HTTP Smuggling via Transfer-Encoding Header in Puma CVSS 3.1HIGH 7.5
- TI-2020-04303 HTTP Response Splitting in Puma CVSS 3.1HIGH 7.5
Sources
- CVE-2020-5249 · CVE Program
- CVE-2020-5249 · NVD
- FIRST EPSS
- GHSA-33vf-4xgg-9r58 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-5249 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences