title: HTTP Smuggling via Transfer-Encoding Header in Puma
description: In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.
problem types: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
affected:
{
product: puma
vendor: puma
versions:
status: affected, version: < 3.12.5
status: affected, version: >= 4.0.0, < 4.3.4
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
]