Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends bytes without CRLF to cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer. This issue is fixed in versions 7.2.1 and 8.0.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| puma | puma | 5.5.0 to before 7.2.1; 8.0.0 to before 8.0.2 | 7.2.1, 8.0.2 | Patch available | CNA |
| — | puma (RubyGems) | 8.0.0 to before 8.0.2 | 8.0.2 | Patch available | GHSA-qpgp-93vx-g8v8 |
| — | puma (RubyGems) | 5.5.0 to before 7.2.1 | 7.2.1 | Patch available | GHSA-qpgp-93vx-g8v8 |
- puma Vendorpuma Affected 5.5.0 to before 7.2.1; 8.0.0 to before 8.0.2 Fixed in 7.2.1, 8.0.2 Patch available CNA
- puma (RubyGems) Vendor— Affected 8.0.0 to before 8.0.2 Fixed in 8.0.2 Patch available GHSA-qpgp-93vx-g8v8
- puma (RubyGems) Vendor— Affected 5.5.0 to before 7.2.1 Fixed in 7.2.1 Patch available GHSA-qpgp-93vx-g8v8
Remediation
- Fix · CNA puma (puma) Fixed in 7.2.1, 8.0.2
- Fix · GHSA-qpgp-93vx-g8v8 puma (RubyGems) Fixed in 8.0.2 Advisory →
- Fix · GHSA-qpgp-93vx-g8v8 puma (RubyGems) Fixed in 7.2.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 5 products
- Red Hat 3scale API Management Platform 2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Satellite 6
Timeline
- 2026-10-02 Threatist record created from CVE-2026-47736
- 2026-10-03 Alias added: GHSA-qpgp-93vx-g8v8
- 2026-10-09 Priority changed: MEDIUM → LOW
- 2026-11-02 5 new references · GHSA-qpgp-93vx-g8v8
References
Other 8
- https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8
- https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f
- https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58
- https://github.com/puma/puma/releases/tag/v7.2.1
- https://github.com/puma/puma/releases/tag/v8.0.2
- https://github.com/puma/puma
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2026-47736.yml
- https://www.cve.org/CVERecord?id=CVE-2026-47736
More puma vulnerabilities
- TI-2022-08603 HTTP Request Smuggling in puma CVSS 3.1CRITICAL 9.1
- TI-2023-21048 Inconsistent Interpretation of HTTP Requests in puma CVSS 3.1CRITICAL 9.8
- TI-2022-07686 Information Exposure when using Puma with Rails CVSS 3.1HIGH 8.0
- TI-2020-08950 HTTP Smuggling via Transfer-Encoding Header in Puma CVSS 3.1HIGH 7.5
- TI-2026-35238 Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections CVSS 3.1HIGH 7.5
- TI-2020-08951 HTTP Smuggling via Transfer-Encoding Header in Puma CVSS 3.1HIGH 7.5
Sources
- CVE-2026-47736 · CVE Program
- CVE-2026-47736 · NVD
- FIRST EPSS
- GHSA-qpgp-93vx-g8v8 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-47736 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences