CVE-2026-47736 - High Severity Vulnerability
Vulnerable Library - puma-8.0.1.gem
Puma is a simple, fast, multi-threaded, and highly parallel HTTP 1.1 server
for Ruby/Rack applications. Puma is intended for use in both development and
production environments. It's great for highly parallel Ruby implementations such as
JRuby and TruffleRuby as well as as providing process worker support to support CRuby well.
Library home page: https://rubygems.org/gems/puma-8.0.1.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /tmp/containerbase/cache/.ruby/cache/puma-8.0.1.gem
Dependency Hierarchy:
- ❌ puma-8.0.1.gem (Vulnerable Library)
Found in base branch: master
Vulnerability Details
Impact "PROXY protocol support for Puma" (https://redirect.github.com/puma/puma/issues/2651) was added in version 5.5.0. When PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer. It waits for "\r\n" to determine whether a PROXY v1 line is present. If an attacker opens a TCP connection and continuously sends bytes without CRLF, Puma keeps appending to this pre-parse buffer. This can cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer for CRLF. A single, unauthenticated TCP connection can drive significant memory growth and may cause process/container OOM or degraded availability. Only Puma servers using the following non-default config are affected: set_remote_address proxy_protocol: :v1 Patches Users should upgrade to versions 7.2.1 or 8.0.2. Workarounds - Disable PROXY protocol v1 parsing if it is not required: remove/comment this: set_remote_address proxy_protocol: :v1 - Restrict direct network access to Puma listeners using PROXY protocol: - Only allow trusted load balancers/reverse proxies to connect. - Block arbitrary client TCP access with firewall/security group rules. Resources - "HAProxy PROXY protocol specification" (https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) - "CWE-400: Uncontrolled Resource Consumption" (https://cwe.mitre.org/data/definitions/400.html) - "CWE-770: Allocation of Resources Without Limits or Throttling" (https://cwe.mitre.org/data/definitions/770.html) - "Puma "set_remote_address" documentation" (https://github.com/puma/puma/blob/master/lib/puma/dsl.rb) - "Puma client PROXY protocol parsing code" (https://github.com/puma/puma/blob/master/lib/puma/client.rb) - "Puma constants, including "PROXY_PROTOCOL_V1_REGEX"" (https://github.com/puma/puma/blob/master/lib/puma/const.rb)
Publish Date: 2026-06-10
URL: CVE-2026-47736
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-qpgp-93vx-g8v8
Release Date: 2026-06-09
Fix Resolution: puma - 8.0.2,puma - 7.2.1
Step up your Open Source Security Game with Mend here
CVE-2026-47736 - High Severity Vulnerability
Puma is a simple, fast, multi-threaded, and highly parallel HTTP 1.1 server for Ruby/Rack applications. Puma is intended for use in both development and production environments. It's great for highly parallel Ruby implementations such as JRuby and TruffleRuby as well as as providing process worker support to support CRuby well.
Library home page: https://rubygems.org/gems/puma-8.0.1.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /tmp/containerbase/cache/.ruby/cache/puma-8.0.1.gem
Dependency Hierarchy:
Found in base branch: master
Impact "PROXY protocol support for Puma" (https://redirect.github.com/puma/puma/issues/2651) was added in version 5.5.0. When PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer. It waits for "\r\n" to determine whether a PROXY v1 line is present. If an attacker opens a TCP connection and continuously sends bytes without CRLF, Puma keeps appending to this pre-parse buffer. This can cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer for CRLF. A single, unauthenticated TCP connection can drive significant memory growth and may cause process/container OOM or degraded availability. Only Puma servers using the following non-default config are affected: set_remote_address proxy_protocol: :v1 Patches Users should upgrade to versions 7.2.1 or 8.0.2. Workarounds - Disable PROXY protocol v1 parsing if it is not required: remove/comment this: set_remote_address proxy_protocol: :v1 - Restrict direct network access to Puma listeners using PROXY protocol: - Only allow trusted load balancers/reverse proxies to connect. - Block arbitrary client TCP access with firewall/security group rules. Resources - "HAProxy PROXY protocol specification" (https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) - "CWE-400: Uncontrolled Resource Consumption" (https://cwe.mitre.org/data/definitions/400.html) - "CWE-770: Allocation of Resources Without Limits or Throttling" (https://cwe.mitre.org/data/definitions/770.html) - "Puma "set_remote_address" documentation" (https://github.com/puma/puma/blob/master/lib/puma/dsl.rb) - "Puma client PROXY protocol parsing code" (https://github.com/puma/puma/blob/master/lib/puma/client.rb) - "Puma constants, including "PROXY_PROTOCOL_V1_REGEX"" (https://github.com/puma/puma/blob/master/lib/puma/const.rb)
Publish Date: 2026-06-10
URL: CVE-2026-47736
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: GHSA-qpgp-93vx-g8v8
Release Date: 2026-06-09
Fix Resolution: puma - 8.0.2,puma - 7.2.1
Step up your Open Source Security Game with Mend here