CVE-2019-16770

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough. This vulnerability is patched in Puma 4.3.1 and 3.12.2.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
puma	puma	>= < 4.3.1, < 4.3.1

References

https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994Mitigation, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/05/msg00034.htmlMailing List, Third Party Advisory
https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994Mitigation, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/05/msg00034.htmlMailing List, Third Party Advisory

Timeline

Published: Dec 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-167716.5Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject a CVE-2019-167726.1The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsa CVE-2019-167749.8In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver.CVE-2019-167756.5Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files o CVE-2019-167768.1Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the inte CVE-2019-167776.5Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binar CVE-2019-167789.8In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this c CVE-2019-167795.9In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as b CVE-2019-16784.3A vulnerability in Cisco Meeting Server could allow an authenticated, remote attacker to cause a partial denial of service (DoS) to Cisco Me CVE-2019-167805.4WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is CVE-2019-167815.4In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, whi CVE-2019-167825.9There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12