PT-2020-18343 · Ruby+1 · Puma+1

Published 2020-02-28 · Updated 2025-09-29 · CVE-2020-5249

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Puma (RubyGem) versions prior to 4.3.3 Puma (RubyGem) versions prior to 3.12.4

Description The issue allows an attacker to inject malicious content, such as additional headers or an entirely new response body, by using a carriage return character to end the header if an application using Puma allows untrusted input in an early-hints header. This is known as HTTP Response Splitting, which is a vector for several other attacks, such as cross-site scripting (XSS).

Recommendations For versions prior to 4.3.3, update to version 4.3.3 or later. For versions prior to 3.12.4, update to version 3.12.4 or later. As a temporary workaround, consider restricting untrusted input in the Early Hints response header to minimize the risk of exploitation.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

CWE-113

Related Identifiers

ALSA-2025_16880

BIT-RUBY-2020-5247

CVE-2020-5249

GHSA-33VF-4XGG-9R58

GHSA-84J7-475P-HP8V

OPENSUSE-SU-2020:1993-1

OPENSUSE-SU-2020:2000-1

OPENSUSE-SU-2020_1993-1

OPENSUSE-SU-2020_2000-1

SUSE-SU-2020:3036-1

SUSE-SU-2020:3147-1

SUSE-SU-2020:3160-1

Affected Products

Puma

Suse

References · 60

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2020-5247.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2020-5249.yml · Exploit
• https://github.com/puma/puma/commit/c22712fc93284a45a93f9ad7023888f3a65524f3 · Patch
• https://osv.dev/vulnerability/GHSA-84j7-475p-hp8v · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/BMJ3CGZ3DLBJ5WUUKMI5ZFXFJQMXJZIK · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ3LL5F5QADB6LM46GXZETREAKZMQNRD · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:3147-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5249 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/NJ3LL5F5QADB6LM46GXZETREAKZMQNRD · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIHVO3CQMU7BZC7FCTSRJ33YDNS3GFPK · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/DIHVO3CQMU7BZC7FCTSRJ33YDNS3GFPK · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5249 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-5247 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMJ3CGZ3DLBJ5WUUKMI5ZFXFJQMXJZIK · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:2000-1 · Vendor Advisory