Read the docs
TI-2021-10217 Aliases CVE-2021-29509GHSA-q28m-8xjw-8vr5

Keepalive Connections Causing Denial Of Service in puma

Priority LOW 36CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A `puma` server which received more concurrent `keep-alive` connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. This problem has been fixed in `puma` 4.3.8 and 5.3.1. Setting `queue_requests false` also fixes the issue. This is not advised when using `puma` without a reverse proxy, such as `nginx` or `apache`, because you will open yourself to slow client attacks (e.g. slowloris). The fix is very small and a git patch is available for those using unsupported versions of Puma.

Why it matters now

EPSS 0.01599 75th percentileScored 2026-11-07
Fix Partial puma (puma): 4.3.8, 5.3.1puma (RubyGems): 4.3.8, 5.3.1Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
pumapumabefore 4.3.8; 5.0.0 to before 5.3.14.3.8, 5.3.1Patch availableCNA
—puma (RubyGems)before 4.3.84.3.8Patch availableGHSA-q28m-8xjw-8vr5
—puma (RubyGems)5.0.0 to before 5.3.15.3.1Patch availableGHSA-q28m-8xjw-8vr5
  • puma Vendorpuma Affected before 4.3.8; 5.0.0 to before 5.3.1 Fixed in 4.3.8, 5.3.1 Patch available CNA
  • puma (RubyGems) Vendor— Affected before 4.3.8 Fixed in 4.3.8 Patch available GHSA-q28m-8xjw-8vr5
  • puma (RubyGems) Vendor— Affected 5.0.0 to before 5.3.1 Fixed in 5.3.1 Patch available GHSA-q28m-8xjw-8vr5

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:puma:puma:*:*:*:*:*:ruby:*:*before 4.3.8; 5.0.0 to before 5.3.1Vulnerablepuma
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:puma:puma:*:*:*:*:*:ruby:*:* Versions before 4.3.8; 5.0.0 to before 5.3.1 Vulnerable ·puma
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · CNA puma (puma) Fixed in 4.3.8, 5.3.1
  • Fix · GHSA-q28m-8xjw-8vr5 puma (RubyGems) Fixed in 4.3.8 Advisory →
  • Fix · GHSA-q28m-8xjw-8vr5 puma (RubyGems) Fixed in 5.3.1 Advisory →

Red Hat 1 advisory

  • RHSA-2021:4702 Released 2021-11-16 · Red Hat rating Moderate
    Satellite 6.10 Release
    • Red Hat Satellite 6.10 candlepin-4.0.9-1.el7sat, foreman-2.5.2.17-2.el7sat, python-aiohttp-3.7.4-1.el7pc +14
    • Red Hat Satellite Capsule 6.10 foreman-2.5.2.17-2.el7sat, python-aiohttp-3.7.4-1.el7pc, python-ecdsa-0.13.3-2.el7pc +9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
CloudForms Management Engine 5AffectedNo fix planned: Will not fix
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat Storage 3AffectedNo fix planned: Will not fix
Red Hat Satellite 6.10Fixed RHSA-2021:4702
Not affected: 3 products
  • Red Hat 3scale API Management Platform 2
  • Red Hat Satellite 6.10
  • Red Hat Satellite Capsule 6.10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-29509
  2. 2026-10-03 Alias added: GHSA-q28m-8xjw-8vr5

References

Patch 2

Advisory 5

Other 2

  • TI-2022-08603 HTTP Request Smuggling in puma CVSS 3.1CRITICAL 9.1
  • TI-2023-21048 Inconsistent Interpretation of HTTP Requests in puma CVSS 3.1CRITICAL 9.8
  • TI-2022-07686 Information Exposure when using Puma with Rails CVSS 3.1HIGH 8.0
  • TI-2020-08950 HTTP Smuggling via Transfer-Encoding Header in Puma CVSS 3.1HIGH 7.5
  • TI-2020-08951 HTTP Smuggling via Transfer-Encoding Header in Puma CVSS 3.1HIGH 7.5
  • TI-2020-04303 HTTP Response Splitting in Puma CVSS 3.1HIGH 7.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences