Every CVE Search/ Get API key

CVE-2021-29509

Keepalive Connections Causing Denial Of Service in puma

7.5 HighFix available

Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A puma server which received more concurrent keep-alive connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. This problem has been fixed in puma 4.3.8 and 5.3.1. Setting queue_requests false also fixes the issue. This is not advised when using puma without a reverse proxy, such as nginx or apache, because you will open yourself to slow client attacks (e.g. slowloris). The fix is very small and a git patch is available for those using unsupported versions of Puma.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.60%Up 0.6 points since May 12, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.5

Keepalive Connections Causing Denial Of Service in puma

Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A puma server which received more concurrent keep-alive connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. This problem has been fixed in puma 4.3.8 and 5.3.1. Setting queue_requests false also fixes the issue. This is not advised when using puma without a reverse proxy, such as nginx or apache, because you will open yourself to slow client attacks (e.g. slowloris). The fix is very small and a git patch is available for those using unsupported versions of Puma.

Record
CVE-2021-29509
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
EUVDEUVD-2021-1158 7.5

Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A puma server which received more concurrent keep-alive connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. This problem has been fixed in puma 4.3.8 and 5.3.1. Setting queue_requests false also fixes the issue. This is not advised when using puma without a reverse proxy, such as nginx or apache, because you will open yourself to slow client attacks (e.g. slowloris). The fix is very small and a git patch is available for those using unsupported versions of Puma.

Record
EUVD-2021-1158
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-q28m-8xjw-8vr5 7.5

Puma's Keepalive Connections Causing Denial Of Service

This vulnerability is related to CVE-2019-16770.

Impact

The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster.

A puma server which received more concurrent keep-alive connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections.

Patches

This problem has been fixed in puma 4.3.8 and 5.3.1.

Workarounds

Setting queue_requests false also fixes the issue. This is not advised when using puma without a reverse proxy, such as nginx or apache, because you will open yourself to slow client attacks (e.g. slowloris).

The fix is very small. A git patch is available here for those using unsupported versions of Puma.

For more information

If you have any questions or comments about this advisory:

Acknowledgements

Thank you to @MSP-Greg, @wjordan and @evanphx for their review on this issue.

Thank you to @ioquatix for providing a modified fork of wrk which made debugging this issue much easier.

Record
GHSA-q28m-8xjw-8vr5
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
NVD 7.5

Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A puma server which received more concurrent keep-alive connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. This problem has been fixed in puma 4.3.8 and 5.3.1. Setting queue_requests false also fixes the issue. This is not advised when using puma without a reverse proxy, such as nginx or apache, because you will open yourself to slow client attacks (e.g. slowloris). The fix is very small and a git patch is available for those using unsupported versions of Puma.

Record
CVE-2021-29509
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-400, CWE-667
Updated
2026-11-02
OSV 7.5

Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A puma server which received more concurrent keep-alive connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. This problem has been fixed in puma 4.3.8 and 5.3.1. Setting queue_requests false also fixes the issue. This is not advised when using puma without a reverse proxy, such as nginx or apache, because you will open yourself to slow client attacks (e.g. slowloris). The fix is very small and a git patch is available for those using unsupported versions of Puma.

Record
CVE-2021-29509
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-29509 7.5

Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A puma server which received more concurrent keep-alive connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. This problem has been fixed in puma 4.3.8 and 5.3.1. Setting queue_requests false also fixes the issue. This is not advised when using puma without a reverse proxy, such as nginx or apache, because you will open yourself to slow client attacks (e.g. slowloris). The fix is very small and a git patch is available for those using unsupported versions of Puma.

Record
DEBIAN-CVE-2021-29509
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 10 moreShow less
OSVGHSA-q28m-8xjw-8vr5 7.5

Puma's Keepalive Connections Causing Denial Of Service

This vulnerability is related to CVE-2019-16770.

Impact

The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster.

A puma server which received more concurrent keep-alive connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections.

Patches

This problem has been fixed in puma 4.3.8 and 5.3.1.

Workarounds

Setting queue_requests false also fixes the issue. This is not advised when using puma without a reverse proxy, such as nginx or apache, because you will open yourself to slow client attacks (e.g. slowloris).

The fix is very small. A git patch is available here for those using unsupported versions of Puma.

For more information

If you have any questions or comments about this advisory:

Acknowledgements

Thank you to @MSP-Greg, @wjordan and @evanphx for their review on this issue.

Thank you to @ioquatix for providing a modified fork of wrk which made debugging this issue much easier.

Record
GHSA-q28m-8xjw-8vr5
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVOESA-2021-1203 7.5

rubygem-puma security update

A simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications.

Security Fix(es):

Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A puma server which received more concurrent keep-alive connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. This problem has been fixed in puma 4.3.8 and 5.3.1. Setting queue_requests False also fixes the issue. This is not advised when using puma without a reverse proxy, such as nginx or apache, because you will open yourself to slow client attacks (e.g. slowloris). The fix is very small and a git patch is available for those using unsupported versions of Puma.(CVE-2021-29509)

Record
OESA-2021-1203
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2021:4702 9.8

Red Hat Security Advisory: Satellite 6.10 Release

Record
RHSA-2021:4702
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-29509 7.5

Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A puma server which received more concurrent keep-alive connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. This problem has been fixed in puma 4.3.8 and 5.3.1. Setting queue_requests false also fixes the issue. This is not advised when using puma without a reverse proxy, such as nginx or apache, because you will open yourself to slow client attacks (e.g. slowloris). The fix is very small and a git patch is available for those using unsupported versions of Puma.

Record
UBUNTU-CVE-2021-29509
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:12592-1 No score

ruby3.1-rubygem-puma-5-5.6.5-1.1 on GA media

These are all security issues fixed in the ruby3.1-rubygem-puma-5-5.6.5-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12592-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13166-1 No score

ruby3.2-rubygem-puma-5-5.6.5-1.7 on GA media

These are all security issues fixed in the ruby3.2-rubygem-puma-5-5.6.5-1.7 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13166-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13721-1 No score

ruby3.3-rubygem-puma-5-5.6.8-1.1 on GA media

These are all security issues fixed in the ruby3.3-rubygem-puma-5-5.6.8-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13721-1
Updated
2026-11-02
OSVSUSE-SU-2021:2761-1 No score

Security update for rubygem-puma

This update for rubygem-puma fixes the following issues:

  • CVE-2021-29509: Incomplete fix for CVE-2019-16770 allows Denial of Service (bsc#1188527)
Record
SUSE-SU-2021:2761-1
Updated
2026-11-02
OSVSUSE-SU-2021:2914-1 No score

Security update for rubygem-puma

This update for rubygem-puma fixes the following issues:

  • CVE-2021-29509: Incomplete fix for CVE-2019-16770 allows Denial of Service (bsc#1188527)
Record
SUSE-SU-2021:2914-1
Updated
2026-11-02
OSVSUSE-SU-2022:1515-1 No score

Security update for rubygem-puma

This update for rubygem-puma fixes the following issues:

rubygem-puma was updated to version 4.3.11:

  • CVE-2021-29509: Adjusted an incomplete fix for allows Denial of Service (DoS) (bsc#1188527)
  • CVE-2021-41136: Fixed request smuggling if HTTP header value contains the LF character (bsc#1191681)
  • CVE-2022-23634: Fixed information leak between requests (bsc#1196222)
Record
SUSE-SU-2022:1515-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
puma
RubyGems
 through 4.3.7
4.3.8
puma
RubyGems
 5.0.0 to 5.3.0
5.3.1
puma
Debian:12
 before 4.3.8-1
4.3.8-1
puma
Debian:13
 before 4.3.8-1
4.3.8-1
puma
Debian:14
 before 4.3.8-1
4.3.8-1
puma
Debian:10
From an advisory covering 4 CVEs
 before 3.12.0-2+deb10u3, plus listed versions
3.12.0-23.12.0-2+deb10u13.12.0-2+deb10u2
3.12.0-2+deb10u3
puma
RubyGems
 before 4.3.8, plus listed versions
0.8.00.8.10.8.20.9.00.9.1
Show 45 moreShow less
0.9.20.9.30.9.40.9.51.0.01.1.01.1.11.2.01.2.11.2.21.3.01.3.11.4.01.5.01.6.01.6.11.6.21.6.32.0.02.0.0.b12.0.0.b22.0.0.b32.0.0.b42.0.0.b52.0.0.b62.0.0.b72.0.12.1.02.1.12.10.02.10.12.10.22.11.02.11.12.11.22.11.32.12.02.12.12.12.22.12.32.13.02.13.12.13.22.13.32.13.4
4.3.8
puma
RubyGems
 5.0.0 up to 5.3.1, plus listed versions
5.0.15.0.25.0.35.0.45.1.0
Show 5 moreShow less
5.1.15.2.05.2.15.2.25.3.0
5.3.1
rubygem-puma
openEuler:20.03-LTS-SP1
 before 3.12.6-2.oe1
3.12.6-2.oe1
python-ecdsa
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:0.13.3-2.el7pc
0:0.13.3-2.el7pc
Show 39 moreShow less
Affected packages
PackageAffectedFixed
python3-ecdsa
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:0.13.3-2.el7pc
0:0.13.3-2.el7pc
python-ecdsa
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:0.13.3-2.el7pc
0:0.13.3-2.el7pc
python3-ecdsa
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:0.13.3-2.el7pc
0:0.13.3-2.el7pc
tfm-rubygem-activerecord-session_store
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:2.0.0-1.el7sat
0:2.0.0-1.el7sat
satellite
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:6.10.0-3.el7sat
0:6.10.0-3.el7sat
satellite
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:6.10.0-3.el7sat
0:6.10.0-3.el7sat
candlepin
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:4.0.9-1.el7sat
0:4.0.9-1.el7sat
python-pyyaml
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:5.4.1-1.el7pc
0:5.4.1-1.el7pc
python3-pyyaml
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:5.4.1-1.el7pc
0:5.4.1-1.el7pc
python-pyyaml
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:5.4.1-1.el7pc
0:5.4.1-1.el7pc
python3-pyyaml
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:5.4.1-1.el7pc
0:5.4.1-1.el7pc
tfm-rubygem-nokogiri
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:1.11.3-2.el7sat
0:1.11.3-2.el7sat
tfm-rubygem-nokogiri
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:1.11.3-2.el7sat
0:1.11.3-2.el7sat
satellite-capsule
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:6.10.0-3.el7sat
0:6.10.0-3.el7sat
foreman
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:2.5.2.17-2.el7sat
0:2.5.2.17-2.el7sat
foreman
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:2.5.2.17-2.el7sat
0:2.5.2.17-2.el7sat
python-aiohttp
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:3.7.4-1.el7pc
0:3.7.4-1.el7pc
python-aiohttp
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:3.7.4-1.el7pc
0:3.7.4-1.el7pc
tfm-rubygem-actionpack
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:6.0.3.7-1.el7sat
0:6.0.3.7-1.el7sat
tfm-rubygem-rails
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:6.0.3.7-1.el7sat
0:6.0.3.7-1.el7sat
python3-django
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:2.2.24-1.el7pc
0:2.2.24-1.el7pc
python3-django
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:2.2.24-1.el7pc
0:2.2.24-1.el7pc
tfm-rubygem-puma
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:5.3.2-1.el7sat
0:5.3.2-1.el7sat
tfm-rubygem-addressable
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:2.8.0-1.el7sat
0:2.8.0-1.el7sat
python-urllib3
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:1.26.5-1.el7pc
0:1.26.5-1.el7pc
python3-urllib3
Red Hat:satellite_capsule:6.10::el7
From an advisory covering 21 CVEs
 before 0:1.26.5-1.el7pc
0:1.26.5-1.el7pc
python-urllib3
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:1.26.5-1.el7pc
0:1.26.5-1.el7pc
python3-urllib3
Red Hat:satellite:6.10::el7
From an advisory covering 21 CVEs
 before 0:1.26.5-1.el7pc
0:1.26.5-1.el7pc
rubygem-puma
SUSE:OpenStack Cloud Crowbar 8
 before 2.16.0-3.12.1
2.16.0-3.12.1
rubygem-puma
SUSE:OpenStack Cloud Crowbar 9
 before 2.16.0-4.12.1
2.16.0-4.12.1
rubygem-puma
SUSE:Linux Enterprise High Availability Extension 15
From an advisory covering 3 CVEs
 before 4.3.11-150000.3.6.2
4.3.11-150000.3.6.2
rubygem-puma
SUSE:Linux Enterprise High Availability Extension 15 SP1
From an advisory covering 3 CVEs
 before 4.3.11-150000.3.6.2
4.3.11-150000.3.6.2
rubygem-puma
SUSE:Linux Enterprise High Availability Extension 15 SP2
From an advisory covering 3 CVEs
 before 4.3.11-150000.3.6.2
4.3.11-150000.3.6.2
rubygem-puma
SUSE:Linux Enterprise High Availability Extension 15 SP3
From an advisory covering 3 CVEs
 before 4.3.11-150000.3.6.2
4.3.11-150000.3.6.2
rubygem-puma
openSUSE:Leap 15.3
From an advisory covering 3 CVEs
 before 4.3.11-150000.3.6.2
4.3.11-150000.3.6.2
rubygem-puma
openSUSE:Leap 15.4
From an advisory covering 3 CVEs
 before 4.3.11-150000.3.6.2
4.3.11-150000.3.6.2
rubygem-puma-5
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 5.6.5-1.1
5.6.5-1.1
ruby3.2-rubygem-puma-5
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 5.6.5-1.7
5.6.5-1.7
rubygem-puma-5
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 5.6.8-1.1
5.6.8-1.1

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-29509 is a high vulnerability (CVSS 7.5) in Puma, published May 11, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.60%, the 75th percentile. Fixed in puma 4.3.8.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 72 versions and 414 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open