CVE-2020-11076 — HTTP Smuggling via Transfer-Encoding Header in Puma

Affected: puma

In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

GHSA-x7jg-6pwg-fx5h — HTTP Smuggling via Transfer-Encoding Header in Puma

Affected: RubyGems: puma

### Impact

By using an invalid transfer-encoding header, an attacker could [smuggle an HTTP response.](https://portswigger.net/web-security/request-smuggling)

Originally reported by @ZeddYu, who has our thanks for the detailed report.

### Patches

The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [Puma](https://github.com/puma/puma) * See our [security policy](https://github.com/puma/puma/security/policy)

Most recent entries from all

CVE-2020-11076 — HTTP Smuggling via Transfer-Encoding Header in Puma

GHSA-x7jg-6pwg-fx5h — HTTP Smuggling via Transfer-Encoding Header in Puma