CVE-2020-5247: HTTP Response Splitting in Puma
Vulnerability summary
CVE-2020-5247 is a high (CVSS 7.5) vulnerability in debian debian_linux. EPSS estimates a 2.55% chance of exploitation in the next 30 days, higher than 85% of scored vulnerabilities.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 10 · Related 10Timeline
- 28-02-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. `CR`, `LF` or`/r`, `/n`) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS). This is related to CVE-2019-16254, which fixed this vulnerability for the WEBrick Ruby web server. This has been fixed in versions 4.3.2 and 3.12.3 by checking all headers for line endings and rejecting headers with those characters.
CVSS metrics
6 scores · 5 sources · 2 versions- CVE.orgCNA6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:LDiffers
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · RubygemsEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:LDiffers
EPSS trend
Probability
2.55%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.55% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-113Improper Neutralization of CRLF Sequences in HTTP HeadersThe product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
- CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream ComponentThe product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Affected systems
Known conditions: network-reachable, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Debian2 products
- puma< 3.12.4-1
- debian_linuxEOL9.0
Fedoraproject1 product
- fedoraEOL30 | 31 | 32
Puma1 product
- puma< 3.12.3 | ≥ 4.0.0, < 4.3.2 | ≤ 3.12.3 | ≥ 4.0.0, ≤ 4.3.2
Ruby-lang1 product
- rubyEOL≤ 2.3.0 | ≥ 2.4.0, ≤ 2.4.7 | ≥ 2.5.0, ≤ 2.5.6 | ≥ 2.6.0, ≤ 2.6.4 | 2.7.0:preview1
RubyGems1 product
- puma< 3.12.4 | ≥ 4.0.0, < 4.3.3
Ubuntu1 product
- puma< 3.12.4-1ubuntu2
6 vendors · 7 products
References
19 links- github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8vX Refsource CONFIRMREPORTWEBMitigationThird Party Advisory
- owasp.org/www-community/attacks/HTTP_Response_SplittingX Refsource MISCREPORTWEBThird Party Advisory
- www.ruby-lang.org/en/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254X Refsource MISCREPORTWEBVendor Advisory
lists.debian.org/debian-lts-announce/2022/05/msg00034.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
Show all 19 references
- github.com/puma/pumaPACKAGE