CVE-2019-16770
1 advisory.
RubyGems/puma CVE-2019-16770: medium 5.3, EPSS 2.01%
A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack
Action: Upgrade puma to 3.12.2 or later.
bundle update pumaAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.12.2 | - |
| 4.0.0 | 4.3.1 | - |
Fixed versions
| 3.12.2 | 4.3.1 |
Sources
- osv: GHSA-7xx3-m584-x994
- https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994
- https://nvd.nist.gov/vuln/detail/CVE-2019-16770
- https://github.com/advisories/GHSA-7xx3-m584-x994
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2019-16770.yml
- https://lists.debian.org/debian-lts-announce/2022/05/msg00034.html
CVE-2019-16770 · published · modified · JSON