Vulnerability-Lookup

CVE-2026-47737 (GCVE-0-2026-47737)

Vulnerability from cvelistv5 – Published: 2026-07-14 19:45 – Updated: 2026-07-14 19:45

Title

Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

Summary

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-290 - Authentication Bypass by Spoofing
CWE-345 - Insufficient Verification of Data Authenticity

Assigner

GitHub_M

References

7 references

URL	Tags
https://github.com/puma/puma/security/advisories/…	x_refsource_CONFIRM
https://github.com/puma/puma/pull/3944	x_refsource_MISC
https://github.com/puma/puma/pull/3947	x_refsource_MISC
https://github.com/puma/puma/commit/439c6136d9c22…	x_refsource_MISC
https://github.com/puma/puma/commit/ebe9db3929ab8…	x_refsource_MISC
https://github.com/puma/puma/releases/tag/v7.2.1	x_refsource_MISC
https://github.com/puma/puma/releases/tag/v8.0.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
puma	puma	Affected: >= 5.5.0, < 7.2.1 Affected: >= 8.0.0, < 8.0.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "puma",
          "vendor": "puma",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.5.0, \u003c 7.2.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290: Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T19:45:16.648Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx"
        },
        {
          "name": "https://github.com/puma/puma/pull/3944",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/puma/puma/pull/3944"
        },
        {
          "name": "https://github.com/puma/puma/pull/3947",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/puma/puma/pull/3947"
        },
        {
          "name": "https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f"
        },
        {
          "name": "https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58"
        },
        {
          "name": "https://github.com/puma/puma/releases/tag/v7.2.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/puma/puma/releases/tag/v7.2.1"
        },
        {
          "name": "https://github.com/puma/puma/releases/tag/v8.0.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/puma/puma/releases/tag/v8.0.2"
        }
      ],
      "source": {
        "advisory": "GHSA-2vqw-3mp8-cgmx",
        "discovery": "UNKNOWN"
      },
      "title": "Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47737",
    "datePublished": "2026-07-14T19:45:16.648Z",
    "dateReserved": "2026-05-19T22:16:39.503Z",
    "dateUpdated": "2026-07-14T19:45:16.648Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-47737",
      "date": "2026-07-15",
      "epss": "0.00177",
      "percentile": "0.07401"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-47737\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-14T20:17:03.767\",\"lastModified\":\"2026-07-14T20:17:03.767\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"puma\",\"product\":\"puma\",\"versions\":[{\"version\":\"\u003e= 5.5.0, \u003c 7.2.1\",\"status\":\"affected\"},{\"version\":\"\u003e= 8.0.0, \u003c 8.0.2\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-290\"},{\"lang\":\"en\",\"value\":\"CWE-345\"}]}],\"references\":[{\"url\":\"https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/puma/puma/pull/3944\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/puma/puma/pull/3947\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/puma/puma/releases/tag/v7.2.1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/puma/puma/releases/tag/v8.0.2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx\",\"source\":\"security-advisories@github.com\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-07-15T10:16:31+00:00",
      "cve": "CVE-2026-47737",
      "id": "CVE-2026-47737",
      "initial_release_date": "2026-07-14T19:45:16.648000+00:00",
      "product_status:known_not_affected": "19",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "puma: Puma: Source IP spoofing via PROXY protocol header re-parsing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47737.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2026-47737

Vulnerability from fkie_nvd - Published: 2026-07-14 20:17 - Updated: 2026-07-14 20:17

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f
	security-advisories@github.com	https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58
	security-advisories@github.com	https://github.com/puma/puma/pull/3944
	security-advisories@github.com	https://github.com/puma/puma/pull/3947
	security-advisories@github.com	https://github.com/puma/puma/releases/tag/v7.2.1
	security-advisories@github.com	https://github.com/puma/puma/releases/tag/v8.0.2
	security-advisories@github.com	https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "puma",
          "vendor": "puma",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.5.0, \u003c 7.2.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.0.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2."
    }
  ],
  "id": "CVE-2026-47737",
  "lastModified": "2026-07-14T20:17:03.767",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-07-14T20:17:03.767",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/puma/puma/pull/3944"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/puma/puma/pull/3947"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/puma/puma/releases/tag/v7.2.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/puma/puma/releases/tag/v8.0.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        },
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-2VQW-3MP8-CGMX

Vulnerability from github – Published: 2026-06-09 00:09 – Updated: 2026-06-09 00:09

Summary

Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

Details

Impact

Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used.

PROXY protocol v1 is a connection-level protocol. Support was added to Puma in v5.5.0. A proxy sends one PROXY header at the beginning of a TCP connection, before any HTTP data. Puma incorrectly re-parsed PROXY protocol headers after each keep-alive request on the same connection. An attacker able to send HTTP requests through a trusted proxy could therefore inject a second PROXY header between HTTP requests. Puma would treat the injected header as authoritative for the next request and overwrite REMOTE_ADDR.

This can mislead applications or middleware that use REMOTE_ADDR for security decisions, rate limiting, auditing, or allow/deny lists.

Only deployments that explicitly enable PROXY protocol v1 are affected, and will have set:

set_remote_address proxy_protocol: :v1

Puma's default configuration is not affected. Deployments that do not use persistent connections to Puma are also not expected to be affected by this issue.

Patches

Users should upgrade to versions 7.2.1 or 8.0.2.

Workarounds

Disable PROXY protocol v1 parsing if it is not required:

ruby # remove/comment this: # set_remote_address proxy_protocol: :v1

Users can also disable persistent connections to Puma, for example:

enable_keep_alives false

References

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "puma"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "puma"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.5.0"
            },
            {
              "fixed": "7.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47737"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-290",
      "CWE-345"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-09T00:09:44Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\n\nPuma is vulnerable to source IP spoofing when `set_remote_address proxy_protocol: :v1` is enabled and persistent connections are used.\n\nPROXY protocol v1 is a connection-level protocol. [Support was added to Puma in v5.5.0](https://github.com/puma/puma/issues/2651). A proxy sends one PROXY header at the beginning of a TCP connection, before any HTTP data. Puma incorrectly re-parsed PROXY protocol headers after each keep-alive request on the same connection. An attacker able to send HTTP requests through a trusted proxy could therefore inject a second PROXY header between HTTP requests. Puma would treat the injected header as authoritative for the next request and overwrite `REMOTE_ADDR`.\n\nThis can mislead applications or middleware that use `REMOTE_ADDR` for security decisions, rate limiting, auditing, or allow/deny lists.\n\n**Only deployments that explicitly enable PROXY protocol v1 are affected**, and will have set:\n\n```ruby\nset_remote_address proxy_protocol: :v1\n```\n\nPuma\u0027s default configuration is not affected. Deployments that do not use persistent connections to Puma are also not expected to be affected by this issue.\n\n### Patches\n\nUsers should upgrade to versions 7.2.1 or 8.0.2.\n\n### Workarounds\n\nDisable PROXY protocol v1 parsing if it is not required:\n\n ```ruby\n   # remove/comment this:\n   # set_remote_address proxy_protocol: :v1\n ```\n\nUsers can also disable persistent connections to Puma, for example:\n\n```ruby\nenable_keep_alives false\n```\n\n### References\n\n- [HAProxy PROXY protocol specification](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)\n- [CVE-2025-31135 / GHSA-c2c3-pqw5-5p7c: go-guerrilla repeated PROXY command source IP spoofing](https://github.com/phires/go-guerrilla/security/advisories/GHSA-c2c3-pqw5-5p7c)\n- [Puma `set_remote_address` documentation](https://github.com/puma/puma/blob/master/lib/puma/dsl.rb)",
  "id": "GHSA-2vqw-3mp8-cgmx",
  "modified": "2026-06-09T00:09:44Z",
  "published": "2026-06-09T00:09:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/puma/puma"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2026-47737.yml"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-47737"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-47737 (GCVE-0-2026-47737)

FKIE_CVE-2026-47737

GHSA-2VQW-3MP8-CGMX

Impact

Patches

Workarounds

References

Tags

Sightings

Nomenclature