CVE-2020-11076

—

CVSS 3.1

7.5 high

EPSS

4%p90

Published

May 22, 2020 (May 22, 2020)

Modified

Jun 17, 2026

Description

In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

Vendors: puma fedoraproject debian
Products: puma, fedora, debian linux
Weakness: CWE-444
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (4.1%)

In the news0 stories

No ingested article mentions this CVE yet.