Puma's Keepalive Connections Causing Denial Of Service

The core of the vulnerability lies in Puma's handling of persistent connections. An attacker can exploit this by sending a large number of concurrent keep-alive requests. Because the initial fix for CVE-2019-16770 was incomplete, new connections can still be starved by these persistent connections, saturating all threads across all Puma processes in a cluster. This effectively prevents legitimate users from accessing the web server, leading to a denial of service. The blast radius is significant, potentially impacting all users relying on the Puma-powered application. The vulnerability allows for resource exhaustion, making the server unresponsive.

Applications built with Ruby on Rails or other Ruby frameworks that rely on Puma as their web server are at risk. Specifically, deployments using Puma in clustered configurations are more vulnerable due to the potential for widespread thread exhaustion. Legacy applications using older Puma versions are also particularly susceptible.

• linux / server: Use ss or lsof to monitor the number of persistent connections to the Puma server. High connection counts, especially from a single source, could indicate an attack. journalctl -u puma can be used to check for errors related to thread exhaustion.

ss -tan | grep :9000  # Replace 9000 with Puma's port
lsof -i :9000

• generic web: Monitor server resource utilization (CPU, memory) for sudden spikes that correlate with increased traffic. Check access logs for unusual patterns of persistent connections from specific IP addresses.

curl -v https://your-puma-server.com/  # Observe keep-alive headers

1. 2021-05-18Disclosure

   disclosure

1. Gereserveerd2021-03-30
2. Gepubliceerd2021-05-18
3. Gewijzigd2026-03-13
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2021-29509 is to upgrade to Puma version 4.3.8 or later, which includes the complete fix. If an immediate upgrade is not feasible, consider implementing rate limiting on incoming connections to prevent an attacker from overwhelming the server with persistent requests. Web Application Firewalls (WAFs) can also be configured to detect and block suspicious connection patterns. Monitor Puma's thread usage and connection counts to identify potential attacks. After upgrading, confirm the fix by simulating a high volume of persistent connections and verifying that the server remains responsive.