Description
In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS). This is related to CVE-2020-5247, which fixed this vulnerability but only for regular responses. This has been fixed in 4.3.3 and 3.12.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| puma | Puma | < 3.12.4, >= 4.0.0, < 4.3.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | puma | 3.12.4-1 | — |
| Debian 13 | puma | 3.12.4-1 | — |
| Debian 12 | puma | 3.12.4-1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | rmt-server | 2.6.5-3.3.1 | SUSE-SU-2020:3036-1 |
| SLES 15 SP1 | rmt-server | 2.6.5-3.18.1 | SUSE-SU-2020:3160-1 |
| SLES 15 | rmt-server | 2.6.5-3.34.1 | SUSE-SU-2020:3147-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 | rmt-server | 2.6.5-3.34.1 | SUSE-SU-2020:3147-1 |
| SLE HPC 15 | rmt-server | 2.6.5-3.34.1 | SUSE-SU-2020:3147-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.2 | rmt-server | 2.6.5-lp152.2.3.1 | openSUSE-SU-2020:1993-1 |
| openSUSE Leap 15.1 | rmt-server | 2.6.5-lp151.2.18.2 | openSUSE-SU-2020:2000-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | puma | < 3.12.4 | 3.12.4 | GHSA-33vf-4xgg-9r58 |
| RubyGems | puma | >= 4.0.0, < 4.3.3 | 4.3.3 | GHSA-33vf-4xgg-9r58 |
Advisories 5
- SUSE-SU-2020:3160-1 Security update for rmt-server SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1993-1 Security update for rmt-server SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:3036-1 Security update for rmt-server SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:3147-1 Security update for rmt-server SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:2000-1 Security update for rmt-server SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://owasp.org/www-community/attacks/HTTP_Response_Splitting
- https://github.com/puma/puma/security/advisories/GHSA-33vf-4xgg-9r58
- https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v
- https://github.com/puma/puma/commit/c22712fc93284a45a93f9ad7023888f3a65524f3
- FEDORA-2020-a3f26a9387 vendor-advisory
- FEDORA-2020-fd87f90634 vendor-advisory
- FEDORA-2020-08092b4c97 vendor-advisory