CVE-2020-11076

HIGH EPSS 89.2%
Published May 22, 20206y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published May 22, 2020 6y ago
Last Modified Jun 17, 2026 2w ago

Description

In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
89.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-444

Affected Products 4

VendorProductVersionRange
pumapuma*≥3.0.0  –  <3.12.6
pumapuma*≥4.0.0  –  <4.3.5
fedoraprojectfedora33any
debiandebian_linux9.0any

References 7

  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00034.html
    Mailing ListThird Party Advisory
  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00038.html
    Mailing ListThird Party Advisory
  • github.com https://github.com/puma/puma/blob/master/History.md#434435-and-31253126--2020-05-22
    Release Notes
  • github.com https://github.com/puma/puma/commit/f24d5521295a2152c286abb0a45a1e1e2bd275bd
    Patch
  • github.com https://github.com/puma/puma/security/advisories/GHSA-x7jg-6pwg-fx5h
    Third Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2020/10/msg00009.html
    Mailing ListThird Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SKIY5H67GJIGJL6SMFWFLUQQQR3EMVPR/

Remediation

  • github.com https://github.com/puma/puma/commit/f24d5521295a2152c286abb0a45a1e1e2bd275bd
    Patch