CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2019-16770
High (7.5). EPSS 2.0% chance of exploitation in the next 30 days. Fixed in puma 3.12.2, 4.3.1.
In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough. This vulnerability is patched in Puma 4.3.1 and 3.12.2.
Severity
- EPSS
- 2.0% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-31)
- CWE
- CWE-770
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- puma:puma
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-7xx3-m584-x994 | RubyGems | puma | <3.12.2 | 3.12.2 |
| GHSA-7xx3-m584-x994 | RubyGems | puma | >=4.0.0 <4.3.1 | 4.3.1 |