DEBIAN-CVE-2019-16770

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2019-16770
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2019-16770.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2019-16770
Upstream
Published
2019-12-05T20:15:10Z
Modified
2025-09-25T01:57:19.422174Z
Summary
[none]
Details

In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough. This vulnerability is patched in Puma 4.3.1 and 3.12.2.

References

Affected packages

Debian:11 / puma

Package

Name
puma
Purl
pkg:deb/debian/puma?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.12.0-4

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / puma

Package

Name
puma
Purl
pkg:deb/debian/puma?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.12.0-4

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / puma

Package

Name
puma
Purl
pkg:deb/debian/puma?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.12.0-4

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / puma

Package

Name
puma
Purl
pkg:deb/debian/puma?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.12.0-4

Ecosystem specific 

{
    "urgency": "not yet assigned"
}