Package Instance

Keepalive thread overload/DoS in puma
A poorly-behaved client could use keepalive requests to monopolize
Puma's reactor and create a denial of service attack.

If more keepalive connections to Puma are opened than there are
threads available, additional connections will wait permanently if
the attacker sends requests frequently enough.

HTTP Response Splitting (Early Hints) in Puma
### Impact
If an application using Puma allows untrusted input in an early-hints header,
an attacker can use a carriage return character to end the header and inject
malicious content, such as additional headers or an entirely new response body.
This vulnerability is known as [HTTP Response
Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting)

While not an attack in itself, response splitting is a vector for several other
attacks, such as cross-site scripting (XSS).

This is related to [CVE-2020-5247](https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v),
which fixed this vulnerability but only for regular responses.

### Patches
This has been fixed in 4.3.3 and 3.12.4.

### Workarounds
Users can not allow untrusted/user input in the Early Hints response header.

HTTP Smuggling via Transfer-Encoding Header in Puma
### Impact

This is a similar but different vulnerability to the one patched in 3.12.5 and 4.3.4.

A client could smuggle a request through a proxy, causing the proxy to send a response
back to another unknown client.

If the proxy uses persistent connections and the client adds another request in via HTTP
pipelining, the proxy may mistake it as the first request's body. Puma, however,
would see it as two requests, and when processing the second request, send back
a response that the proxy does not expect. If the proxy has reused the persistent
connection to Puma to send another request for a different client, the second response
from the first client will be sent to the second client.

### Patches

The problem has been fixed in Puma 3.12.6 and Puma 4.3.5.

HTTP Smuggling via Transfer-Encoding Header in Puma
### Impact

By using an invalid transfer-encoding header, an attacker could
[smuggle an HTTP response.](https://portswigger.net/web-security/request-smuggling)

### Patches

The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

HTTP Response Splitting vulnerability in puma
If an application using Puma allows untrusted input in a response header,
an attacker can use newline characters (i.e. CR, LF) to end the header and
inject malicious content, such as additional headers or an entirely new
response body. This vulnerability is known as HTTP Response Splitting.

While not an attack in itself, response splitting is a vector for several
other attacks, such as cross-site scripting (XSS).