{"action":"Upgrade puma to 3.12.2 or later.","affected":[{"fixed":"3.12.2","introduced":"0"},{"fixed":"4.3.1","introduced":"4.0.0"}],"component":"puma","cve_ids":["CVE-2019-16770"],"ecosystem":"RubyGems","epss":0.02014,"exploited":false,"fixed_versions":["3.12.2","4.3.1"],"ghsa_id":"GHSA-7xx3-m584-x994","id":"tcs_01M5KEHVGT18N2QW382CJHG50Q","modified_at":"2026-07-08T06:00:11.133080946Z","published_at":"2019-12-05T19:26:37Z","references":["https://osv.dev/vulnerability/GHSA-7xx3-m584-x994","https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994","https://nvd.nist.gov/vuln/detail/CVE-2019-16770","https://github.com/advisories/GHSA-7xx3-m584-x994","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2019-16770.yml","https://lists.debian.org/debian-lts-announce/2022/05/msg00034.html"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-7xx3-m584-x994","url":"https://osv.dev/vulnerability/GHSA-7xx3-m584-x994"}],"summary":"A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack"}