| Package | Affected versions | Patched versions |
|---|---|---|
| puma | ≥ 4.0.0, < 4.3.4< 3.12.5 | 4.3.43.12.5 |
| puma | ≥ 3.0.0, < 3.12.6≥ 4.0.0, < 4.3.5 | 3.12.64.3.5 |
By using an invalid transfer-encoding header, an attacker could smuggle an HTTP response.
Originally reported by @ZeddYu, who has our thanks for the detailed report.
The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free