CVE-2020-11077

In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. This is a similar but different vulnerability from CVE-2020-11076. The problem has been fixed in Puma 3.12.6 and Puma 4.3.5.

• CWE-444
• CWE-444

• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00034.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00038.htmlMailing List, Third Party Advisory
• https://github.com/puma/puma/blob/master/History.md#434435-and-31253126--2020-05-22Release Notes
• https://github.com/puma/puma/security/advisories/GHSA-w64w-qqph-5gxmVendor Advisory
• https://lists.debian.org/debian-lts-announce/2020/10/msg00009.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SKIY5H67GJIGJL6SMFWFLUQQQR3EMVPR/
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00034.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00038.htmlMailing List, Third Party Advisory
• https://github.com/puma/puma/blob/master/History.md#434435-and-31253126--2020-05-22Release Notes
• https://github.com/puma/puma/security/advisories/GHSA-w64w-qqph-5gxmVendor Advisory
• https://lists.debian.org/debian-lts-announce/2020/10/msg00009.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SKIY5H67GJIGJL6SMFWFLUQQQR3EMVPR/

Published

May 22, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11071SLPJS (npm package slpjs) before version 0.27.2, has a vulne…8.6
• CVE-2020-11072In SLP Validate (npm package slp-validate) before version 1.…8.6
• CVE-2020-11073In Autoswitch Python Virtualenv before version 0.16.0, a use…7.8
• CVE-2020-11074In PrestaShop from version 1.5.3.0 and before version 1.7.6.…5.4
• CVE-2020-11075In Anchore Engine version 0.7.0, a specially crafted contain…9.9
• CVE-2020-11076In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could…7.5
• CVE-2020-11078In httplib2 before version 0.18.0, an attacker controlling u…6.8
• CVE-2020-11079node-dns-sync (npm module dns-sync) through 0.2.0 allows exe…9.8
• CVE-2020-1108A denial of service vulnerability exists when .NET Core or .…7.5
• CVE-2020-11080In nghttp2 before version 1.41.0, the overly large HTTP/2 SE…7.5
• CVE-2020-11081osquery before version 4.4.0 enables a privilege escalation …8.2
• CVE-2020-11082In Kaminari before 1.2.1, there is a vulnerability that woul…6.1