CVE-2020-5247

Name of the Vulnerable Software and Affected Versions: Puma versions prior to 4.3.2 Puma versions prior to 3.12.3

Description: The issue is related to HTTP Response Splitting, where an attacker can use newline characters (CR, LF, or /r, /n) to end a header and inject malicious content, such as additional headers or a new response body. This can be a vector for other attacks, including cross-site scripting (XSS).

Recommendations: For versions prior to 4.3.2, update to version 4.3.2 or later. For versions prior to 3.12.3, update to version 3.12.3 or later. As a temporary workaround, consider restricting untrusted input in response headers to minimize the risk of exploitation.