VYPR
← All advisories
High severityNVD Advisory· Published May 22, 2020· Updated Aug 4, 2024

HTTP Smuggling via Transfer-Encoding Header in Puma

CVE-2020-11076

Description

In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Puma before 4.3.4 and 3.12.5 allows HTTP response smuggling via an invalid Transfer-Encoding header.

Vulnerability

In Puma, a Ruby web server, an attacker can exploit a response smuggling vulnerability by sending a request with an invalid Transfer-Encoding header. The server fails to properly validate the header, allowing an attacker to inject a second, attacker-controlled response (CVE-2020-11076). [1]

Exploitation

The attack does not require authentication; it can be performed by any client able to send HTTP requests to the server. By crafting a request with a malformed Transfer-Encoding header, an attacker can cause Puma to misinterpret the boundaries between consecutive HTTP responses. This can lead to a scenario where the first response is truncated and the attacker's crafted response is appended, potentially poisoning intermediary caches or affecting other clients. [2]

Impact

Successful exploitation allows an attacker to perform HTTP response smuggling. This can result in cache poisoning, where a proxy or browser caches the attacker's malicious response instead of the legitimate one. Other impacts include session hijacking and cross-site scripting (XSS), depending on how the application and downstream proxies handle the injected content. [3][4]

Mitigation

The vulnerability has been fixed in Puma versions 4.3.4 and 3.12.5. Users should upgrade to these versions or later immediately. No workaround is available. [1]

References
  1. puma/History.md at main · puma/puma
  2. GitHub - puma/puma: A Ruby/Rack web server built for parallelism
  3. NVD - CVE-2020-11076
  4. ruby-advisory-db/gems/puma/CVE-2020-11076.yml at master · rubysec/ruby-advisory-db

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pumaRubyGems
< 3.12.53.12.5
pumaRubyGems
>= 4.0.0, < 4.3.44.3.4

Affected products

219

Patches

1
f24d5521295a

Better handle client input

https://github.com/puma/pumaEvan PhoenixMay 18, 2020via ghsa
commit
1 file changed · +10 −2
  • lib/puma/client.rb+10 −2 modified
    @@ -285,8 +285,16 @@ def setup_body
 
       te = @env[TRANSFER_ENCODING2]
 
-      if te && CHUNKED.casecmp(te) == 0
-        return setup_chunked_body(body)
+      if te
+        if te.include?(",")
+          te.split(",").each do |part|
+            if CHUNKED.casecmp(part.strip) == 0
+              return setup_chunked_body(body)
+            end
+          end
+        elsif CHUNKED.casecmp(te) == 0
+          return setup_chunked_body(body)
+        end
       end
 
       @chunked_body = false

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

11

News mentions

0

No linked articles in our index yet.