Read the docs
TI-2020-08950 Aliases CVE-2020-11076GHSA-x7jg-6pwg-fx5h

HTTP Smuggling via Transfer-Encoding Header in Puma

Priority MEDIUM 40CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

Why it matters now

EPSS 0.04088 90th percentileScored 2026-11-07
Fix Partial puma (puma): 3.12.5, 4.3.4puma (RubyGems): 3.12.5, 4.3.4Red Hat: 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
pumapumabefore 3.12.5; 4.0.0 to before 4.3.43.12.5, 4.3.4Patch availableCNA
—puma (RubyGems)before 3.12.53.12.5Patch availableGHSA-x7jg-6pwg-fx5h
—puma (RubyGems)4.0.0 to before 4.3.44.3.4Patch availableGHSA-x7jg-6pwg-fx5h
  • puma Vendorpuma Affected before 3.12.5; 4.0.0 to before 4.3.4 Fixed in 3.12.5, 4.3.4 Patch available CNA
  • puma (RubyGems) Vendor— Affected before 3.12.5 Fixed in 3.12.5 Patch available GHSA-x7jg-6pwg-fx5h
  • puma (RubyGems) Vendor— Affected 4.0.0 to before 4.3.4 Fixed in 4.3.4 Patch available GHSA-x7jg-6pwg-fx5h

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:puma:puma:*:*:*:*:*:ruby:*:*3.0.0 to before 3.12.6; 4.0.0 to before 4.3.5Vulnerablepuma
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*33VulnerableFedoraproject
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
  • cpe:2.3:a:puma:puma:*:*:*:*:*:ruby:*:* Versions 3.0.0 to before 3.12.6; 4.0.0 to before 4.3.5 Vulnerable ·puma
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian

Remediation

  • Fix · CNA puma (puma) Fixed in 3.12.5, 4.3.4
  • Fix · GHSA-x7jg-6pwg-fx5h puma (RubyGems) Fixed in 3.12.5 Advisory →
  • Fix · GHSA-x7jg-6pwg-fx5h puma (RubyGems) Fixed in 4.3.4 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    puma — openSUSE-SU-2020:0990

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2020-08951 HTTP Smuggling via Transfer-Encoding Header in PumaPriority LOW 38
    Show all 2 records → Advisory →
  • Advisory ·

    puma — openSUSE-SU-2020:1001

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2020-08951 HTTP Smuggling via Transfer-Encoding Header in PumaPriority LOW 38
    Show all 2 records → Advisory →
Show 1 more group
  • Advisory ·

    puma — FEDORA-2020-fe354f24e8

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2020-08951 HTTP Smuggling via Transfer-Encoding Header in PumaPriority LOW 38
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
CloudForms Management Engine 5AffectedNo fix planned: Will not fix
Red Hat Storage 3AffectedNo fix planned: Will not fix

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-11076
  2. 2026-10-03 Alias added: GHSA-x7jg-6pwg-fx5h

References

Patch 1

Advisory 6

Other 4

  • TI-2022-08603 HTTP Request Smuggling in puma CVSS 3.1CRITICAL 9.1
  • TI-2023-21048 Inconsistent Interpretation of HTTP Requests in puma CVSS 3.1CRITICAL 9.8
  • TI-2022-07686 Information Exposure when using Puma with Rails CVSS 3.1HIGH 8.0
  • TI-2020-08951 HTTP Smuggling via Transfer-Encoding Header in Puma CVSS 3.1HIGH 7.5
  • TI-2020-04303 HTTP Response Splitting in Puma CVSS 3.1HIGH 7.5
  • TI-2019-12551 Potential DOS attack in Puma CVSS 3.1HIGH 7.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences