https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T12:20:19.445359+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2020-11076 CVE-2020-11076 — HTTP Smuggling via Transfer-Encoding Header in Puma 2026-10-06T12:20:19.463464+00:00

Affected: puma

In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

 https://cve.radiocsirt.org/vuln/ghsa-x7jg-6pwg-fx5h GHSA-x7jg-6pwg-fx5h — HTTP Smuggling via Transfer-Encoding Header in Puma 2026-10-06T12:20:19.463533+00:00

Affected: RubyGems: puma

### Impact

By using an invalid transfer-encoding header, an attacker could [smuggle an HTTP response.](https://portswigger.net/web-security/request-smuggling)

Originally reported by @ZeddYu, who has our thanks for the detailed report.

### Patches

The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [Puma](https://github.com/puma/puma) * See our [security policy](https://github.com/puma/puma/security/policy)