CVE-2019-16770
A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack
Impact
## Keepalive thread overload/DoS ### Impact A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough. ### Patches This vulnerability is patched in Puma 4.3.1 and 3.12.2. ### Workarounds Reverse proxies in front of Puma could be configured to always allow less than X keepalive connections to a Puma cluster or process, where X is the number of threads configured in Puma's thread pool. ### For more information If you have any questions or comments about this advisory: * Open an issue at [puma](github.com/puma/puma).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | puma | < 3.12.2 | 3.12.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Puma | Puma | from 3.0.0 before 3.12.2 from 4.0.0 before 4.3.1 |
| Debian | Debian Linux | Version 9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994
- https://lists.debian.org/debian-lts-announce/2022/05/msg00034.html
- https://github.com/advisories/GHSA-7xx3-m584-x994
- https://nvd.nist.gov/vuln/detail/CVE-2019-16770
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2019-16770.yml