Puma's Keepalive Connections Causing Denial Of ServiceGHSA-q28m-8xjw-8vr5
HIGHGHSA-q28m-8xjw-8vr5 is a high-severity (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in puma. A fix is available for puma — see the affected versions and patch details below.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
puma💎pumaReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.
Description
This vulnerability is related to CVE-2019-16770.
Impact
The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster.
A puma server which received more concurrent keep-alive connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections.
Patches
This problem has been fixed in puma 4.3.8 and 5.3.1.
Workarounds
Setting queue_requests false also fixes the issue. This is not advised when using puma without a reverse proxy, such as nginx or apache, because you will open yourself to slow client attacks (e.g. slowloris).
The fix is very small. A git patch is available here for those using unsupported versions of Puma.
For more information
If you have any questions or comments about this advisory:
- Open an issue in Puma.
- To report problems with this fix or to report another vulnerability, see our security policy.
Acknowledgements
Thank you to @MSP-Greg, @wjordan and @evanphx for their review on this issue.
Thank you to @ioquatix for providing a modified fork of wrk which made debugging this issue much easier.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 💎RubyGems | puma | all versions | 4.3.8bundle update puma --conservative |
| 💎RubyGems | puma | ≥ 5.0.0&&< 5.3.1 | 5.3.1bundle update puma --conservative |
Affected Products
debian linuxdebianpumapumaDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for puma, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update puma to 4.3.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-q28m-8xjw-8vr5 is resolved across your whole dependency graph.
Workarounds
Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
Red Hat CloudForms 5.0 (CFME 5.11) is in the maintenance support phase and we are no longer fixing Medium/Low severity security bugs. Reference: https://access.redhat.com/support/policy/updates/cloudforms
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat Satellite 6.10 for RHEL 7 | tfm-rubygem-puma-0:5.3.2-1.el7sat | RHSA-2021:4702 |
Frequently Asked Questions
Is GHSA-q28m-8xjw-8vr5 in your dependencies?
Find it across RubyGems, including transitive dependencies.