CVE-2019-16770: Potential DOS attack in Puma

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-12-05 · updated 2026-06-17
Weakness: CWE-770

Description

In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough. This vulnerability is patched in Puma 4.3.1 and 3.12.2.

Affected products

Debian Linux: 9.0
puma: from 3.0.0 before 3.12.2; from 4.0.0 before 4.3.1 — fixed in 3.12.2, 4.3.1
Rubygems Puma: before 3.12.2; from 4.0.0 before 4.3.1; 0.8.0, 0.8.1, 0.8.2, 0.9.0, 0.9.1, 0.9.2 (+106) — fixed in 3.12.2, 4.3.1

How to fix

Upgrade to a fixed version: puma 3.12.2, 4.3.1; Rubygems Puma 3.12.2, 4.3.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-16770 or the next vulnerability affects your stack