CVE-2020-11076: Debian Linux

High severity, CVSS 7.5. EPSS: 4.1% chance of exploitation in the next 30 days.

In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

Affected products

• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 33 only
• Puma Puma: from 3.0.0, before 3.12.6 (fixed in 3.12.6); from 4.0.0, before 4.3.5 (fixed in 4.3.5)

Published 2020-05-22. Last modified 2026-06-17.