Skip to content
OpenAdvisories
High DLA-2398-1 2 CVEs

puma - security update

Published Oct 7, 2020 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 puma 3.6.0-1+deb9u1

Vulnerabilities 2

  • High 7.5
    CVE-2020-11076 Public exploit

    HTTP Smuggling via Transfer-Encoding Header in Puma

    In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

    puma puma puma puma Debian Ubuntu RubyGems
  • Medium 6.8
    CVE-2020-11077

    HTTP Smuggling via Transfer-Encoding Header in Puma

    In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelini…

    puma puma puma puma Debian Ubuntu RubyGems