CVE-2020-5249

In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS). This is related to CVE-2020-5247, which fixed this vulnerability but only for regular responses. This has been fixed in 4.3.3 and 3.12.4.

• CWE-113
• CWE-74

• https://github.com/puma/puma/commit/c22712fc93284a45a93f9ad7023888f3a65524f3Patch, Third Party Advisory
• https://github.com/puma/puma/security/advisories/GHSA-33vf-4xgg-9r58Third Party Advisory
• https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8vThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMJ3CGZ3DLBJ5WUUKMI5ZFXFJQMXJZIK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIHVO3CQMU7BZC7FCTSRJ33YDNS3GFPK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ3LL5F5QADB6LM46GXZETREAKZMQNRD/
• https://owasp.org/www-community/attacks/HTTP_Response_SplittingThird Party Advisory
• https://github.com/puma/puma/commit/c22712fc93284a45a93f9ad7023888f3a65524f3Patch, Third Party Advisory
• https://github.com/puma/puma/security/advisories/GHSA-33vf-4xgg-9r58Third Party Advisory
• https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8vThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMJ3CGZ3DLBJ5WUUKMI5ZFXFJQMXJZIK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIHVO3CQMU7BZC7FCTSRJ33YDNS3GFPK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ3LL5F5QADB6LM46GXZETREAKZMQNRD/
• https://owasp.org/www-community/attacks/HTTP_Response_SplittingThird Party Advisory

Published

Mar 2, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-5243uap-core before 0.7.3 is vulnerable to a denial of service a…7.5
• CVE-2020-5244In BuddyPress before 5.1.2, requests to a certain REST API e…7.5
• CVE-2020-5245Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arb…8.8
• CVE-2020-5246Traccar GPS Tracking System before version 4.9 has a LDAP in…6.5
• CVE-2020-5247In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an appl…7.5
• CVE-2020-5248GLPI before before version 9.4.6 has a vulnerability involvi…5.3
• CVE-2020-5250In PrestaShop before version 1.7.6.4, when a customer edits …6.3
• CVE-2020-5251In parser-server before version 4.1.0, you can fetch all the…5.3
• CVE-2020-5252The command-line "safety" package for Python has a potential…4.1
• CVE-2020-5253NetHack before version 3.6.0 allowed malicious use of escapi…9.8
• CVE-2020-5254In NetHack before 3.6.6, some out-of-bound values for the hi…8.1
• CVE-2020-5255In Symfony before versions 4.4.7 and 5.0.7, when a `Response…4.3