Vulnerability · Published May 11, 2021 · Assigned by GitHub_M
CVE-2021-29509Keepalive Connections Causing Denial Of Service in puma
High 7.5
In plain English
A high-severity uncontrolled resource consumption in puma from puma. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A `puma` server which received more concurrent `keep-alive` connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. This problem has been fixed in `puma` 4.3.8 and 5.3.1. Setting `queue_requests false` also fixes the issue. This is not advised when using `puma` without a reverse proxy, such as `nginx` or `apache`, because you will open yourself to slow client attacks (e.g. slowloris). The fix is very small and a git patch is available for those using unsupported versions of Puma.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | puma | 4.3.8-1 | DEBIAN-CVE-2021-29509 |
| Debian:13 | puma | 4.3.8-1 | DEBIAN-CVE-2021-29509 |
| Debian:14 | puma | 4.3.8-1 | DEBIAN-CVE-2021-29509 |
| RubyGems | puma | 4.3.8 | GHSA-q28m-8xjw-8vr5 |
| RubyGems | puma | 5.3.1 | GHSA-q28m-8xjw-8vr5 |
| Ubuntu:22.04:LTS | puma | 5.5.2-2ubuntu2 | UBUNTU-CVE-2021-29509 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/puma/puma/security/advisories/GHSA-q28m-8xjw-8vr5 x_refsource_CONFIRM
- https://gist.github.com/nateberkopec/4b3ea5676c0d70cbb37c82d54be25837 x_refsource_MISC
- https://github.com/puma/puma/security/policy x_refsource_MISC
- https://rubygems.org/gems/puma x_refsource_MISC
- GLSA-202208-28 vendor-advisory, x_refsource_GENTOO
- [debian-lts-announce] 20220827 [SECURITY] [DLA 3083-1] puma security update mailing-list, x_refsource_MLIST