CVE-2020-5249

CVE-2020-5249 describes an HTTP Response Splitting vulnerability in Puma (RubyGem) versions prior to 4.3.3 and 3.12.4. This flaw allows an attacker to inject malicious content, such as additional headers or a new response body, if the application processes untrusted input in an early-hints header. Rated Medium severity (CVSS 6.5), the vulnerability has a network attack vector and low attack complexity, potentially leading to high integrity impact, though it does not directly affect confidentiality or availability. While not an attack itself, it serves as a vector for other attacks like Cross-Site Scripting (XSS). There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. The vulnerability has received minimal community discussion or media coverage.