Log in Start free

Vulnerability · Published Jul 14, 2026 · Assigned by GitHub_M

CVE-2026-47737Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

High 7.5

In plain English

A high-severity authentication bypass by spoofing in puma from puma. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.2%top 92.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12puma5.6.5-3+deb12u2DEBIAN-CVE-2026-47737
Debian:13pumano fix listedDEBIAN-CVE-2026-47737
Debian:14puma8.0.2-1DEBIAN-CVE-2026-47737
RubyGemspuma7.2.1GHSA-2vqw-3mp8-cgmx
RubyGemspuma8.0.2GHSA-2vqw-3mp8-cgmx
Ubuntu:24.04:LTSpumano fix listedUBUNTU-CVE-2026-47737
Ubuntu:26.04:LTSpumano fix listedUBUNTU-CVE-2026-47737
Ubuntu:26.10pumano fix listedUBUNTU-CVE-2026-47737

Affected products (as reported)

VendorProductVersions
puma puma >= 5.5.0, < 7.2.1>= 8.0.0, < 8.0.2

Weakness: CWE-290, CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References