CVE catalog

CVE-2019-16770

puma: CVE-2019-16770

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.01% · Oct 27, 2026

In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough. This vulnerability is patched in Puma 4.3.1 and 3.12.2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpumasid8.0.2-3fixed
Debianpumaforky8.0.2-3fixed
Debianpumatrixie6.6.0-4fixed
Debianpumabookworm5.6.5-3+deb12u1fixed
Debianpumabookworm-security5.6.5-3+deb12u2fixed
Opensuserubygem-pumatumbleweed6.4.3-1.5fixed
Suserubygem-pumaopenstack cloud 6-ltss2.16.0-4.3.1fixed
Susermt-serverlinux enterprise module for public cloud 15 sp12.6.5-3.18.1fixed
Susermt-serverlinux enterprise module for server applications 15 sp12.6.5-3.18.1fixed
Opensusermt-serverleap 15.22.6.5-lp152.2.3.1fixed
Opensuseruby3.2-rubygem-puma-5tumbleweed5.6.5-1.7fixed
Susecrowbar-coreopenstack cloud 74.0+git.1578392992.fabfd186c-9.63.1fixed
Susecrowbar-openstackopenstack cloud 74.0+git.1579171175.d53ab6363-9.68.1fixed
Suseopenstack-neutron-fwaasopenstack cloud 79.0.2~dev5-4.6.1fixed
Suseopenstack-neutron-fwaas-docopenstack cloud 79.0.2~dev5-4.6.1fixed
Suserubygem-crowbar-clientopenstack cloud 73.9.1-7.17.1fixed
Opensuserubygem-pumatumbleweed6.4.3-1.3fixed
Opensuserubygem-pumatumbleweed5.6.2-1.1fixed
Opensuseruby3.2-rubygem-pumatumbleweed6.0.0-2.1fixed
Opensuserubygem-puma-4tumbleweed4.3.10-1.1fixed
Susermt-serverlinux enterprise module for public cloud 15 sp22.6.5-3.3.1fixed
Susermt-serverlinux enterprise module for server applications 15 sp22.6.5-3.3.1fixed
Susermt-serverlinux enterprise high performance computing 15-espos2.6.5-3.34.1fixed
Susermt-serverlinux enterprise high performance computing 15-ltss2.6.5-3.34.1fixed
Susermt-serverlinux enterprise server 15-ltss2.6.5-3.34.1fixed
Susermt-serverlinux enterprise server for sap applications 152.6.5-3.34.1fixed
Opensusermt-serverleap 15.12.6.5-lp151.2.18.2fixed
Opensuserubygem-puma-5tumbleweed5.6.8-1.1fixed
Opensuserubygem-puma-5tumbleweed5.6.5-1.1fixed
Opensuserubygem-pumatumbleweed6.4.2-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpumasourcesid3.12.0-4not yet assignedNot reported[946312]
Debianpumasourceforky3.12.0-4not yet assignedNot reported[946312]
Debianpumasourcetrixie3.12.0-4not yet assignedNot reported[946312]
Debianpumasourcebookworm3.12.0-4not yet assignedNot reported[946312]
Opensuserubygem-pumarpmtumbleweed6.4.3-1.5Not reportedOPENSUSE-SU-2026:10357-1Not reported
Suserubygem-pumarpmopenstack cloud 6-ltss2.16.0-4.3.1Not reportedSUSE-SU-2020:2060-1Not reported
Susermt-serverrpmlinux enterprise module for public cloud 15 sp12.6.5-3.18.1Not reportedSUSE-SU-2020:3160-1Not reported
Susermt-serverrpmlinux enterprise module for server applications 15 sp12.6.5-3.18.1Not reportedSUSE-SU-2020:3160-1Not reported
Opensusermt-serverrpmleap 15.22.6.5-lp152.2.3.1Not reportedOPENSUSE-SU-2020:1993-1Not reported
Opensuseruby3.2-rubygem-puma-5rpmtumbleweed5.6.5-1.7Not reportedOPENSUSE-SU-2024:13166-1Not reported
Susecrowbar-corerpmopenstack cloud 74.0+git.1578392992.fabfd186c-9.63.1Not reportedSUSE-SU-2020:0311-1Not reported
Susecrowbar-openstackrpmopenstack cloud 74.0+git.1579171175.d53ab6363-9.68.1Not reportedSUSE-SU-2020:0311-1Not reported
Suseopenstack-neutron-fwaasrpmopenstack cloud 79.0.2~dev5-4.6.1Not reportedSUSE-SU-2020:0311-1Not reported
Suseopenstack-neutron-fwaas-docrpmopenstack cloud 79.0.2~dev5-4.6.1Not reportedSUSE-SU-2020:0311-1Not reported
Suserubygem-crowbar-clientrpmopenstack cloud 73.9.1-7.17.1Not reportedSUSE-SU-2020:0311-1Not reported
Opensuserubygem-pumarpmtumbleweed6.4.3-1.3Not reportedOPENSUSE-SU-2025:15123-1Not reported
Opensuserubygem-pumarpmtumbleweed5.6.2-1.1Not reportedOPENSUSE-SU-2024:11847-1Not reported
Opensuseruby3.2-rubygem-pumarpmtumbleweed6.0.0-2.1Not reportedOPENSUSE-SU-2024:12900-1Not reported
Opensuserubygem-puma-4rpmtumbleweed4.3.10-1.1Not reportedOPENSUSE-SU-2024:11830-1Not reported
Susermt-serverrpmlinux enterprise module for public cloud 15 sp22.6.5-3.3.1Not reportedSUSE-SU-2020:3036-1Not reported
Susermt-serverrpmlinux enterprise module for server applications 15 sp22.6.5-3.3.1Not reportedSUSE-SU-2020:3036-1Not reported
Susermt-serverrpmlinux enterprise high performance computing 15-espos2.6.5-3.34.1Not reportedSUSE-SU-2020:3147-1Not reported
Susermt-serverrpmlinux enterprise high performance computing 15-ltss2.6.5-3.34.1Not reportedSUSE-SU-2020:3147-1Not reported
Susermt-serverrpmlinux enterprise server 15-ltss2.6.5-3.34.1Not reportedSUSE-SU-2020:3147-1Not reported
Susermt-serverrpmlinux enterprise server for sap applications 152.6.5-3.34.1Not reportedSUSE-SU-2020:3147-1Not reported
Opensusermt-serverrpmleap 15.12.6.5-lp151.2.18.2Not reportedOPENSUSE-SU-2020:2000-1Not reported
Opensuserubygem-puma-5rpmtumbleweed5.6.8-1.1Not reportedOPENSUSE-SU-2024:13721-1Not reported
Opensuserubygem-puma-5rpmtumbleweed5.6.5-1.1Not reportedOPENSUSE-SU-2024:12592-1Not reported
Opensuserubygem-pumarpmtumbleweed6.4.2-1.1Not reportedOPENSUSE-SU-2024:13720-1Not reported

[Debian bug #946312]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [ruby4.0-rubygem-puma]Unknown

    Source package: [rubygem-puma]

    Details (1)

    • 6.4.3-1.9 · x86_64 · tumbleweed

      Unknown · Fixed: 5.6.2-1.1, 6.4.2-1.1, 6.4.3-1.3, 6.4.3-1.5

      Version impact unknown

      dsa · rubygem-puma · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [puma]Fixed
    Details (2)

    • 5.6.5-3+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.12.0-4

      dsa · puma · debian · bookworm; dsa · puma · debian · 12

    • 5.6.5-3+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.12.0-4

      dsa · puma · debian · bookworm; dsa · puma · debian · 12

[Debian 13 (Trixie)]

  • [puma]Fixed
    Details (2)

    • 6.6.0-4 · amd64 · trixie

      Fixed · Fixed: 3.12.0-4

      dsa · puma · debian · 13

    • 6.6.0-4 · arm64 · trixie

      Fixed · Fixed: 3.12.0-4

      dsa · puma · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]