HTTP Smuggling via Transfer-Encoding Header in Puma

The core of this vulnerability lies in Puma's handling of HTTP requests within a proxy environment. An attacker can craft a malicious request that, when passed through a proxy, is misinterpreted by Puma. This misinterpretation can lead to the proxy sending a response intended for another client back to the attacker, effectively hijacking the connection. HTTP pipelining exacerbates the issue, as the attacker can inject additional requests into the pipeline, further confusing the proxy and Puma's processing. The potential impact includes unauthorized access to sensitive data, session hijacking, and potentially even remote code execution if the proxy is misconfigured or vulnerable itself.

Organizations utilizing Puma as their web server, particularly those operating behind reverse proxies or load balancers, are at risk. Environments with legacy proxy configurations or those relying on HTTP pipelining are especially vulnerable. Ruby applications deployed in production using Puma are also at risk.

• linux / server:

journalctl -u puma -g "unexpected response" -g "request smuggling"

• generic web:

curl -v <target_url> 2>&1 | grep -i 'HTTP/1.1 100 Continue' # Check for unexpected 100 Continue responses

1. 2020-05-22Disclosure

   disclosure

1. Gereserveerd2020-03-30
2. Gepubliceerd2020-05-22
3. Gewijzigd2026-03-13
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2020-11077 is to upgrade Puma to version 3.12.6 or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds. Carefully review proxy configurations to ensure proper request handling and prevent unexpected behavior. Deploying a Web Application Firewall (WAF) with rules to detect and block HTTP smuggling attempts can provide an additional layer of defense. Monitor Puma logs for unusual patterns or errors that might indicate exploitation. Specifically, look for discrepancies in request processing times or unexpected responses.