CVE-2019-16770: Potential DOS attack in Puma
A flaw was found in rubygem-puma. A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough.
Other sources
In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough. This vulnerability is patched in Puma 4.3.1 and 3.12.2.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2019-16770?
CVE-2019-16770 is a vulnerability found in the rubygem-puma library, which allows a poorly-behaved client to create a denial of service attack by monopolizing Puma's reactor using keepalive requests.
How does CVE-2019-16770 affect the rubygem-puma library?
CVE-2019-16770 affects versions 3.12.2 and 4.3.1 of the rubygem-puma library.
What is the severity of CVE-2019-16770?
CVE-2019-16770 has a severity level of high.
How can the CVE-2019-16770 vulnerability be fixed?
To fix the CVE-2019-16770 vulnerability, update to version 3.12.2 or 4.3.1 of the rubygem-puma library.
What is the Common Weakness Enumeration (CWE) ID for CVE-2019-16770?
The Common Weakness Enumeration (CWE) ID for CVE-2019-16770 is CWE-770.