CVE-2020-5247: In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newlin...

Description

In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. `CR`, `LF` or`/r`, `/n`) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS). This is related to CVE-2019-16254, which fixed this vulnerability for the WEBrick Ruby web server. This has been fixed in versions 4.3.2 and 3.12.3 by checking all headers for line endings and rejecting headers with those characters.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Probability

2.49%

82.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions	Update
Puma	Puma	<= 3.12.3	—
Puma	Puma	>= 4.0.0, <= 4.3.2	—
Ruby-Lang	Ruby	<= 2.3.0	—
Ruby-Lang	Ruby	>= 2.4.0, <= 2.4.7	—
Ruby-Lang	Ruby	>= 2.5.0, <= 2.5.6	—
Ruby-Lang	Ruby	>= 2.6.0, <= 2.6.4	—
Ruby-Lang	Ruby	2.7.0	Preview1
Debian	Debian Linux	9.0	—
Fedoraproject	Fedora	30	—
Fedoraproject	Fedora	31	—
Fedoraproject	Fedora	32	—

References

Timeline

Published: Feb 28, 2020
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2020-5247?

In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. `CR`, `LF` or`/r`, `/n`) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS). This is related to CVE-2019-16254, which fixed this vulnerability for the WEBrick Ruby web server. This has been fixed in versions 4.3.2 and 3.12.3 by checking all headers for line endings and rejecting headers with those characters.

How severe is CVE-2020-5247?

CVE-2020-5247 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 2.49% probability of exploitation in the next 30 days.

How do I fix CVE-2020-5247?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.