{"action":"Upgrade puma to 3.12.4 or later.","affected":[{"fixed":"3.12.4","introduced":"0"},{"fixed":"4.3.3","introduced":"4.0.0"}],"component":"puma","cve_ids":["CVE-2020-5249"],"ecosystem":"RubyGems","epss":0.01571,"exploited":false,"fixed_versions":["3.12.4","4.3.3"],"ghsa_id":"GHSA-33vf-4xgg-9r58","id":"tcs_01M5KEG5DKTZH1A9W6VW9NMAKX","modified_at":"2026-02-04T04:19:30.628978Z","published_at":"2020-03-03T23:33:16Z","references":["https://osv.dev/vulnerability/GHSA-33vf-4xgg-9r58","https://github.com/puma/puma/security/advisories/GHSA-33vf-4xgg-9r58","https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v","https://nvd.nist.gov/vuln/detail/CVE-2020-5249","https://github.com/puma/puma/commit/c22712fc93284a45a93f9ad7023888f3a65524f3","https://github.com/puma/puma","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2020-5249.yml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BMJ3CGZ3DLBJ5WUUKMI5ZFXFJQMXJZIK","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DIHVO3CQMU7BZC7FCTSRJ33YDNS3GFPK","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJ3LL5F5QADB6LM46GXZETREAKZMQNRD","https://owasp.org/www-community/attacks/HTTP_Response_Splitting"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-33vf-4xgg-9r58","url":"https://osv.dev/vulnerability/GHSA-33vf-4xgg-9r58"}],"summary":"HTTP Response Splitting (Early Hints) in Puma"}