Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-290.
Summary
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| puma | puma | 5.5.0 to before 7.2.1; 8.0.0 to before 8.0.2 | 7.2.1, 8.0.2 | Patch available | CNA |
| — | puma (RubyGems) | 8.0.0 to before 8.0.2 | 8.0.2 | Patch available | GHSA-2vqw-3mp8-cgmx |
| — | puma (RubyGems) | 5.5.0 to before 7.2.1 | 7.2.1 | Patch available | GHSA-2vqw-3mp8-cgmx |
- puma Vendorpuma Affected 5.5.0 to before 7.2.1; 8.0.0 to before 8.0.2 Fixed in 7.2.1, 8.0.2 Patch available CNA
- puma (RubyGems) Vendor— Affected 8.0.0 to before 8.0.2 Fixed in 8.0.2 Patch available GHSA-2vqw-3mp8-cgmx
- puma (RubyGems) Vendor— Affected 5.5.0 to before 7.2.1 Fixed in 7.2.1 Patch available GHSA-2vqw-3mp8-cgmx
Remediation
- Fix · CNA puma (puma) Fixed in 7.2.1, 8.0.2
- Fix · GHSA-2vqw-3mp8-cgmx puma (RubyGems) Fixed in 8.0.2 Advisory →
- Fix · GHSA-2vqw-3mp8-cgmx puma (RubyGems) Fixed in 7.2.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 5 products
- Red Hat 3scale API Management Platform 2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Satellite 6
Timeline
- 2026-10-02 Threatist record created from CVE-2026-47737
- 2026-10-03 Alias added: GHSA-2vqw-3mp8-cgmx
- 2026-11-02 7 new references · GHSA-2vqw-3mp8-cgmx
References
Other 10
- https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx
- https://github.com/puma/puma/pull/3944
- https://github.com/puma/puma/pull/3947
- https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f
- https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58
- https://github.com/puma/puma/releases/tag/v7.2.1
- https://github.com/puma/puma/releases/tag/v8.0.2
- https://github.com/puma/puma
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2026-47737.yml
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-47737
More puma vulnerabilities
- TI-2022-08603 HTTP Request Smuggling in puma CVSS 3.1CRITICAL 9.1
- TI-2023-21048 Inconsistent Interpretation of HTTP Requests in puma CVSS 3.1CRITICAL 9.8
- TI-2022-07686 Information Exposure when using Puma with Rails CVSS 3.1HIGH 8.0
- TI-2020-08950 HTTP Smuggling via Transfer-Encoding Header in Puma CVSS 3.1HIGH 7.5
- TI-2026-35237 Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion CVSS 3.1HIGH 7.5
- TI-2020-08951 HTTP Smuggling via Transfer-Encoding Header in Puma CVSS 3.1HIGH 7.5
Sources
- CVE-2026-47737 · CVE Program
- CVE-2026-47737 · NVD
- FIRST EPSS
- GHSA-2vqw-3mp8-cgmx · GitHub Advisory Database · CC BY 4.0
- CVE-2026-47737 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences