HTTP response splitting via unsanitized header newlines

HTTP response splitting in Puma before 4.3.2 and 3.12.3 allows remote attackers to inject headers or response bodies through untrusted response-header input. Puma's response-header handling accepts CR or LF characters from application-supplied values, allowing those characters to terminate a header and append attacker-controlled headers or a second body. Exploitation requires an application route that copies attacker-influenced data into a response header; consequences include response manipulation and downstream attacks such as cross-site scripting, not automatic server takeover.