PT-2020-3713

Name of the Vulnerable Software and Affected Versions: Puma versions prior to 3.12.5 Puma versions prior to 4.3.4 Description: The issue is related to the handling of HTTP requests in Puma, a RubyGem for Ruby/Rack applications. An attacker could smuggle an HTTP response by using an invalid...

HTTP Response Splitting

puma is vulnerable to HTTP response splitting. The attack exist because it does not properly handle the CRLF carriage feed or line return characters injection in early hints response header, allowing an attacker to inject CRLF to end the the HTTP response header and manipulate with malicious...