CVE-2019-16770

In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use
keepalive requests to monopolize Puma’s reactor and create a denial of
service attack. If more keepalive connections to Puma are opened than there
are threads available, additional connections will wait permanently if the
attacker sends requests frequently enough. This vulnerability is patched in
Puma 4.3.1 and 3.12.2.