Keepalive Connections Causing Denial Of Service in puma

Vulnerability

The fix for CVE-2019-16770 in Puma was incomplete. In Puma versions prior to 4.3.8 and 5.3.1, a server receiving more concurrent keep-alive connections than available threads in its threadpool would service only a subset of connections, denying service to the unserved ones. The original fix protected existing connections but not new ones. This affects all Puma versions in the 4.x and 5.x lines before the patched releases [1][2].

Exploitation

An attacker can exploit this by opening numerous persistent keep-alive connections to the Puma server, exceeding the threadpool size. The attacker requires network access to the server and no authentication. By saturating all threads with greedy persistent connections, new legitimate connections are starved and denied service. The attacker does not need to send any malicious payload, simply a large number of concurrent connections [1][2].

Impact

Successful exploitation results in a denial of service (DoS) condition. Legitimate clients cannot establish new connections or have their requests serviced, leading to service unavailability. The impact is on availability only; no data confidentiality or integrity is compromised [1][2].

Mitigation

The vulnerability is fixed in Puma 4.3.8 and 5.3.1. Users should upgrade to these versions or later. A workaround is to set queue_requests false, but this is not recommended without a reverse proxy (e.g., nginx, Apache) as it exposes the server to slow client attacks like slowloris. A git patch is available for unsupported versions [1][2][3].