VYPR
← All advisories
Moderate severityNVD Advisory· Published Dec 5, 2019· Updated Aug 5, 2024

Potential DOS attack in Puma

CVE-2019-16770

Description

In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough. This vulnerability is patched in Puma 4.3.1 and 3.12.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A keepalive request flooding bug in Puma <3.12.2 / <4.3.1 lets an attacker monopolize the reactor, causing permanent connection hangs.

Vulnerability

Puma versions before 3.12.2 and 4.3.1 contain a denial-of-service flaw in how they handle keepalive HTTP connections. When a client opens more persistent (keepalive) connections than the number of threads available in Puma's thread pool, and sends requests frequently enough, the reactor thread can be monopolized. Legitimate new connections then wait indefinitely because no thread becomes free to process them. [1][2]

Attack

Vector An attacker needs only the ability to open multiple TCP connections to a vulnerable Puma server and send keepalive requests at a high frequency. No authentication is required. The attack is purely network-level; by saturating the thread pool with keepalive connections, the attacker prevents the server from handling any further requests. [3]

Impact

Successful exploitation results in a complete denial of service: all subsequent legitimate HTTP requests are blocked, and connections queue up permanently, effectively taking the server offline. The vulnerability is rated moderate severity and has been documented in the GitHub Advisory Database. [3][4]

Mitigation

Puma versions 3.12.2 and 4.3.1 patch the issue. Administrators who cannot upgrade immediately can configure a reverse proxy (e.g., nginx, HAProxy) to limit the number of keepalive connections per Puma process to fewer than the thread pool size. No other workaround is available. [1][4]

References
  1. NVD - CVE-2019-16770
  2. ruby-advisory-db/gems/puma/CVE-2019-16770.yml at master · rubysec/ruby-advisory-db
  3. CVE-2019-16770 - GitHub Advisory Database
  4. Keepalive thread overload/DoS

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pumaRubyGems
< 3.12.23.12.2
pumaRubyGems
>= 4.0.0, < 4.3.14.3.1

Affected products

337

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.