CVE-2020-11076 — HTTP Smuggling via Transfer-Encoding Header in Puma

Description

In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

Affected products

Vendor	Product	Affected	Fixed
puma	puma	< 3.12.5, >= 4.0.0, < 4.3.4	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	puma	4.3.6-1	—
Debian 13	puma	4.3.6-1	—
Debian 12	puma	4.3.6-1	—
Debian 9	puma	3.6.0-1+deb9u1	DLA-2398-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu Pro 22.04 LTS	puma	5.5.2-2ubuntu2+esm1	USN-6682-1
Ubuntu Pro 20.04 LTS	puma	3.12.4-1ubuntu2+esm1	USN-6682-1

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP2	rmt-server	2.6.5-3.3.1	SUSE-SU-2020:3036-1
SLES 15 SP2	rubygem-puma	4.3.5-3.3.1	SUSE-SU-2020:1919-1
SLES 15 SP1	rmt-server	2.6.5-3.18.1	SUSE-SU-2020:3160-1
SLES 15 SP1	rubygem-puma	4.3.5-3.3.1	SUSE-SU-2020:1919-1
SLES 15	rmt-server	2.6.5-3.34.1	SUSE-SU-2020:3147-1
SLES 15	rubygem-puma	4.3.5-3.3.1	SUSE-SU-2020:1919-1

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 15	rmt-server	2.6.5-3.34.1	SUSE-SU-2020:3147-1
SLE HPC 15	rmt-server	2.6.5-3.34.1	SUSE-SU-2020:3147-1
SUSE OpenStack Cloud Crowbar 8	ansible	2.4.6.0-3.9.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	caasp-openstack-heat-templates	1.0+git.1560518045.ad7dc6d-4.18.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	crowbar-core	5.0+git.1593156248.55bbdb26d-3.41.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	crowbar-openstack	5.0+git.1593085772.64c4ab43c-4.40.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	documentation-suse-openstack-cloud-deployment +3	8.20200527-1.26.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	grafana	4.6.5-4.9.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	kibana	4.6.3-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	openstack-dashboard	12.0.5~dev3-3.26.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	openstack-heat-templates	0.0.0+git.1582270132.8a20477-3.15.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	openstack-keystone +1	12.0.4~dev11-5.33.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	openstack-monasca-agent	2.2.6~dev4-3.18.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	openstack-monasca-installer	20190923_16.32-3.12.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	openstack-neutron +1	11.0.9~dev65-3.33.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	openstack-octavia-amphora-image	0.1.4-3.12.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-Django	1.11.23-3.15.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-Flask	0.12.1-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-Pillow	4.2.1-3.5.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-amqp	2.4.2-3.12.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-apicapi	1.6.0-3.6.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-keystoneauth1	3.1.2~dev2-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-oslo.messaging	5.30.8-3.11.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-psutil	5.2.2-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-pyroute2	0.4.21-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-pysaml2	4.0.2-5.6.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-tooz	1.58.1-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	python-waitress	1.4.3-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	rubygem-activeresource	4.0.0-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	rubygem-crowbar-client	3.9.2-3.12.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	rubygem-json-1_7	1.7.7-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	rubygem-puma	2.16.0-3.9.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud Crowbar 8	storm	1.1.3-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ansible	2.4.6.0-3.9.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ansible1	1.9.6-7.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-ansible	8.0+git.1589740980.6c3bcdc-3.73.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-cluster	8.0+git.1585685203.3e71e49-3.36.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-freezer	8.0+git.1586539529.b7d295f-3.21.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-input-model	8.0+git.1589740934.0e0ad61-3.39.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-logging	8.0+git.1591194866.b7375d0-3.24.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-mq	8.0+git.1589715269.62ad6df-3.22.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-neutron	8.0+git.1590756744.ba84abc-3.42.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-octavia	8.0+git.1590100427.cf4cc8f-3.29.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	ardana-osconfig	8.0+git.1587034587.eac37b8-3.45.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	caasp-openstack-heat-templates	1.0+git.1560518045.ad7dc6d-4.18.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	documentation-suse-openstack-cloud-user +8	8.20200527-1.26.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	grafana	4.6.5-4.9.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	kibana	4.6.3-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	openstack-dashboard	12.0.5~dev3-3.26.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	openstack-heat-templates	0.0.0+git.1582270132.8a20477-3.15.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	openstack-keystone +1	12.0.4~dev11-5.33.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	openstack-monasca-agent	2.2.6~dev4-3.18.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	openstack-monasca-installer	20190923_16.32-3.12.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	openstack-neutron +1	11.0.9~dev65-3.33.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	openstack-octavia-amphora-image	0.1.4-3.12.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-Django	1.11.23-3.15.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-Flask	0.12.1-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-GitPython	2.1.8-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-Pillow	4.2.1-3.5.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-amqp	2.4.2-3.12.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-apicapi	1.6.0-3.6.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-keystoneauth1	3.1.2~dev2-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-oslo.messaging	5.30.8-3.11.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-psutil	5.2.2-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-pyroute2	0.4.21-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-pysaml2	4.0.2-5.6.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-tooz	1.58.1-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	python-waitress	1.4.3-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	storm	1.1.3-3.3.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-aodh	5.1.1~dev7-12.26.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-barbican	5.0.2~dev3-12.27.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-ceilometer	9.0.8~dev7-12.24.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-cinder	11.2.3~dev23-14.27.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-designate	5.0.3~dev7-12.25.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-freezer	5.0.0.0~xrc2~dev2-10.22.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-glance	15.0.3~dev3-12.25.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-heat	9.0.8~dev22-12.27.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-horizon	12.0.5~dev3-14.30.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-ironic	9.1.8~dev8-12.27.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-keystone	12.0.4~dev11-11.28.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-magnum	5.0.2_5.0.2_5.0.2~dev31-11.26.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-manila	5.1.1~dev5-12.31.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-monasca	2.2.2~dev1-11.22.3	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-monasca-ceilometer	1.5.1_1.5.1_1.5.1~dev3-8.22.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-murano	4.0.2~dev2-12.22.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-neutron	11.0.9~dev65-13.30.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-nova	16.1.9~dev61-11.28.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-octavia	1.0.6~dev3-12.27.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-sahara	7.0.5~dev4-11.26.2	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-swift	2.15.2_2.15.2_2.15.2~dev32-11.18.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 8	venv-openstack-trove	8.0.2~dev2-11.26.1	SUSE-SU-2020:1901-1
SUSE OpenStack Cloud 7	ansible	2.2.3.0-12.2	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	crowbar-core	4.0+git.1580209654.1d112d31f-9.66.5	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	crowbar-ha	4.0+git.1585316203.d6ad2c8-4.52.4	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	crowbar-openstack	4.0+git.1589804581.9972163f0-9.71.4	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	grafana	4.6.5-1.14.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	keepalived	2.0.19-1.8.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	kibana	4.6.3-5.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	memcached	1.5.17-3.6.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	monasca-installer	20180608_12.47-12.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-dashboard-theme-SUSE	2016.2-5.12.4	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-manila	3.0.1~dev30-4.12.2	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-manila-doc	3.0.1~dev30-4.12.3	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-neutron-fwaas	9.0.2~dev5-4.9.3	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-neutron-fwaas-doc	9.0.2~dev5-4.9.4	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-nova +1	14.0.11~dev13-4.40.2	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-tempest	12.2.1~a0~dev177-4.9.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-Django	1.8.19-3.23.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-Pillow	2.8.1-4.12.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-psql2mysql	0.5.0+git.1589351878.4ef877c-1.12.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-psutil	1.2.1-21.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-py	1.8.1-11.12.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-pysaml2	4.0.2-3.17.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-waitress	1.4.3-3.3.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	rabbitmq-server	3.4.4-3.16.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	release-notes-suse-openstack-cloud	7.20180803-3.18.3	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	rubygem-activeresource	4.0.0-3.3.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	rubygem-crowbar-client	3.9.2-7.20.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	rubygem-json-1_7	1.7.7-3.3.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	rubygem-puma	2.16.0-4.6.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	zookeeper	3.4.10-6.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 6	rubygem-puma	2.16.0-4.3.1	SUSE-SU-2020:2060-1
SUSE HPE Helion OpenStack 8	ansible	2.4.6.0-3.9.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ansible1	1.9.6-7.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-ansible	8.0+git.1589740980.6c3bcdc-3.73.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-cluster	8.0+git.1585685203.3e71e49-3.36.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-freezer	8.0+git.1586539529.b7d295f-3.21.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-input-model	8.0+git.1589740934.0e0ad61-3.39.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-logging	8.0+git.1591194866.b7375d0-3.24.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-mq	8.0+git.1589715269.62ad6df-3.22.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-neutron	8.0+git.1590756744.ba84abc-3.42.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-octavia	8.0+git.1590100427.cf4cc8f-3.29.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	ardana-osconfig	8.0+git.1587034587.eac37b8-3.45.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	caasp-openstack-heat-templates	1.0+git.1560518045.ad7dc6d-4.18.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	documentation-hpe-helion-openstack-user +5	8.20200527-1.26.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	grafana	4.6.5-4.9.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	kibana	4.6.3-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-dashboard	12.0.5~dev3-3.26.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-dashboard-theme-HPE	8+git.1523473653.6599ec8-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-heat-templates	0.0.0+git.1582270132.8a20477-3.15.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-keystone +1	12.0.4~dev11-5.33.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-monasca-agent	2.2.6~dev4-3.18.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-monasca-installer	20190923_16.32-3.12.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-neutron +1	11.0.9~dev65-3.33.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	openstack-octavia-amphora-image	0.1.4-3.12.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-Django	1.11.23-3.15.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-Flask	0.12.1-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-GitPython	2.1.8-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-Pillow	4.2.1-3.5.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-amqp	2.4.2-3.12.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-apicapi	1.6.0-3.6.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-keystoneauth1	3.1.2~dev2-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-oslo.messaging	5.30.8-3.11.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-psutil	5.2.2-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-pyroute2	0.4.21-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-pysaml2	4.0.2-5.6.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-tooz	1.58.1-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	python-waitress	1.4.3-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	storm	1.1.3-3.3.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-aodh	5.1.1~dev7-12.26.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-barbican	5.0.2~dev3-12.27.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-ceilometer	9.0.8~dev7-12.24.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-cinder	11.2.3~dev23-14.27.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-designate	5.0.3~dev7-12.25.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-freezer	5.0.0.0~xrc2~dev2-10.22.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-glance	15.0.3~dev3-12.25.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-heat	9.0.8~dev22-12.27.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-horizon-hpe	12.0.5~dev3-14.30.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-ironic	9.1.8~dev8-12.27.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-keystone	12.0.4~dev11-11.28.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-magnum	5.0.2_5.0.2_5.0.2~dev31-11.26.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-manila	5.1.1~dev5-12.31.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-monasca	2.2.2~dev1-11.22.3	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-monasca-ceilometer	1.5.1_1.5.1_1.5.1~dev3-8.22.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-murano	4.0.2~dev2-12.22.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-neutron	11.0.9~dev65-13.30.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-nova	16.1.9~dev61-11.28.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-octavia	1.0.6~dev3-12.27.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-sahara	7.0.5~dev4-11.26.2	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-swift	2.15.2_2.15.2_2.15.2~dev32-11.18.1	SUSE-SU-2020:1901-1
SUSE HPE Helion OpenStack 8	venv-openstack-trove	8.0.2~dev2-11.26.1	SUSE-SU-2020:1901-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	rmt-server	2.6.13-1.1	openSUSE-SU-2024:10589-1
openSUSE Tumbleweed	ruby3.2-rubygem-puma	6.0.0-2.1	openSUSE-SU-2024:12900-1
openSUSE Tumbleweed	ruby3.2-rubygem-puma-5	5.6.5-1.7	openSUSE-SU-2024:13166-1
openSUSE Tumbleweed	rubygem-puma	5.6.2-1.1	openSUSE-SU-2026:10357-1, openSUSE-SU-2025:15123-1, openSUSE-SU-2024:13720-1
openSUSE Tumbleweed	rubygem-puma-4	4.3.10-1.1	openSUSE-SU-2024:11830-1
openSUSE Tumbleweed	rubygem-puma-5	5.6.5-1.1	openSUSE-SU-2024:13721-1, openSUSE-SU-2024:12592-1
openSUSE Leap 15.2	rmt-server	2.6.5-lp152.2.3.1	openSUSE-SU-2020:1993-1
openSUSE Leap 15.2	rubygem-puma	4.3.5-lp152.4.3.1	openSUSE-SU-2020:1001-1
openSUSE Leap 15.1	rmt-server	2.6.5-lp151.2.18.2	openSUSE-SU-2020:2000-1
openSUSE Leap 15.1	rubygem-puma	4.3.5-lp151.3.3.1	openSUSE-SU-2020:0990-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

dentarg/cougar ★ 0 · May 21, 2020

Puma, CVE-2020-11076 and CVE-2020-11077

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
RubyGems	puma	< 3.12.5	3.12.5	GHSA-x7jg-6pwg-fx5h
RubyGems	puma	>= 4.0.0, < 4.3.4	4.3.4	GHSA-x7jg-6pwg-fx5h

Advisories 23

USN-6682-1 puma vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
openSUSE-SU-2026:10357-1 ruby4.0-rubygem-puma-6.4.3-1.5 on GA media SUSE / openSUSE Security Updates · Mar 14, 2026
DLA-2398-1 puma - security update Debian Security (DSA / DLA) · Mar 9, 2026
SUSE-SU-2020:2060-1 Security update for rubygem-puma SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2020:1001-1 Security update for rubygem-puma SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2020:3160-1 Security update for rmt-server SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2020:1993-1 Security update for rmt-server SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2020:1919-1 Security update for rubygem-puma SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2020:0990-1 Security update for rubygem-puma SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:13166-1 ruby3.2-rubygem-puma-5-5.6.5-1.7 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2025:15123-1 ruby3.4-rubygem-puma-6.4.3-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-RU-2020:2072-1 Security update for ansible, crowbar-core, crowbar-ha, crowbar-openstack, etcd, flannel, grafana, keepalived, kibana, memcached, monasca-installer, openstack-dashboard-theme-SUSE, openstack-manila, openstack-neutron-fwaas, openstack-nova, openstack-tempest, python-Django, python-Pillow, python-psql2mysql, python-psutil, python-py, python-pysaml2, python-waitress, rabbitmq-server, release-notes-suse-openstack-cloud, zookeeper SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:11847-1 ruby3.1-rubygem-puma-5.6.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:12900-1 ruby3.2-rubygem-puma-6.0.0-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:11830-1 ruby3.1-rubygem-puma-4-4.3.10-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2020:1901-1 Security update for ansible, ansible1, ardana-ansible, ardana-cluster, ardana-freezer, ardana-input-model, ardana-logging, ardana-mq, ardana-neutron, ardana-octavia, ardana-osconfig, caasp-openstack-heat-templates, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-dashboard, openstack-dashboard-theme-HPE, openstack-heat-templates, openstack-keystone, openstack-monasca-agent, openstack-monasca-installer, openstack-neutron, openstack-octavia-amphora-im SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2020:3036-1 Security update for rmt-server SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2020:3147-1 Security update for rmt-server SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2020:2000-1 Security update for rmt-server SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:13721-1 ruby3.3-rubygem-puma-5-5.6.8-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:10589-1 rmt-server-2.6.13-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:12592-1 ruby3.1-rubygem-puma-5-5.6.5-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:13720-1 ruby3.3-rubygem-puma-6.4.2-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025

References

https://github.com/puma/puma/security/advisories/GHSA-x7jg-6pwg-fx5h
https://github.com/puma/puma/blob/master/History.md#434435-and-31253126--2020-05-22
https://github.com/puma/puma/commit/f24d5521295a2152c286abb0a45a1e1e2bd275bd
openSUSE-SU-2020:0990 vendor-advisory
openSUSE-SU-2020:1001 vendor-advisory
FEDORA-2020-fe354f24e8 vendor-advisory
[debian-lts-announce] 20201007 [SECURITY] [DLA 2398-1] puma security update mailing-list

CNA	v3.1	7.5
EUVD	v3.1	7.5
OSV:GHSA	v3.1	7.5