CVE-2020-5249

Name of the Vulnerable Software and Affected Versions Puma (RubyGem) versions prior to 4.3.3 Puma (RubyGem) versions prior to 3.12.4

Description The issue allows an attacker to inject malicious content, such as additional headers or an entirely new response body, by using a carriage return character to end the header if an application using Puma allows untrusted input in an early-hints header. This is known as HTTP Response Splitting, which is a vector for several other attacks, such as cross-site scripting (XSS).

Recommendations For versions prior to 4.3.3, update to version 4.3.3 or later. For versions prior to 3.12.4, update to version 3.12.4 or later. As a temporary workaround, consider restricting untrusted input in the Early Hints response header to minimize the risk of exploitation.