CVE-2019-16770 : What You Need to Know

Prior to Puma versions 3.12.2 and 4.3.1, an ill-behaved client could exploit Puma's reactor using keepalive requests, leading to a denial of service attack. Learn about the impact, technical details, and mitigation steps.

Understanding CVE-2019-16770

In Puma versions 3.12.2 and 4.3.1, a vulnerability allowed attackers to perform a denial of service attack by overloading Puma's reactor with keepalive requests.

What is CVE-2019-16770?

This CVE refers to a vulnerability in Puma versions 3.12.2 and 4.3.1 that could be exploited by malicious clients using keepalive requests to trigger a denial of service attack.

The Impact of CVE-2019-16770

CVSS Base Score: 5.3 (Medium)
Attack Vector: Network
Attack Complexity: Low
Availability Impact: Low
Privileges Required: None
CWE ID: CWE-770 Allocation of Resources Without Limits or Throttling

Technical Details of CVE-2019-16770

Vulnerability Description

Attackers could exploit Puma's reactor with keepalive requests, causing a denial of service by creating more connections than available threads.

Affected Systems and Versions

Product: Puma
Vendor: Puma
Versions Affected: < 4.3.1

Exploitation Mechanism

Attackers could send frequent keepalive requests to overwhelm Puma's reactor, leading to a denial of service condition.

Mitigation and Prevention

Immediate Steps to Take

Configure reverse proxies to limit keepalive connections to Puma.

Long-Term Security Practices

Regularly update Puma to the latest version to patch known vulnerabilities.

Patching and Updates

Ensure Puma is updated to version 4.3.1 or 3.12.2 to mitigate the vulnerability.