PT-2019-14826 · Ruby+1 · Puma+1
Nateberkopec
·
Published
2019-12-05
·
Updated
2026-03-13
·
CVE-2019-16770
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Puma versions prior to 3.12.2
Puma versions prior to 4.3.1
Description
A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough.
Recommendations
For versions prior to 3.12.2, update to version 3.12.2 or later to resolve the issue.
For versions prior to 4.3.1, update to version 4.3.1 or later to resolve the issue.
As a temporary workaround, consider configuring reverse proxies in front of Puma to always allow less than X keepalive connections to a Puma cluster or process, where X is the number of threads configured in Puma's thread pool.
Exploit
Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Puma
Suse