{"id":"CVE-2026-47736","kind":"vulnerability","aliases":["CVE-2026-47736","GHSA-qpgp-93vx-g8v8"],"related":[],"title":"Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion","description":"### Impact\n\n[PROXY protocol support for Puma](https://github.com/puma/puma/issues/2651) was added in version 5.5.0.\n\nWhen PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer. It waits for \"\\r\\n\" to determine whether a PROXY v1 line is present. If an attacker opens a TCP connection and continuously sends bytes without CRLF, Puma keeps appending to this pre-parse buffer.\n\nThis can cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer for CRLF. A single, unauthenticated TCP connection can drive significant memory growth and may cause process/container OOM or degraded availability.\n\n**Only Puma servers using the following non-default config are affected:**\n\n```ruby\n   set_remote_address proxy_protocol: :v1\n```\n\n### Patches\n\nUsers should upgrade to versions 7.2.1 or 8.0.2.\n\n### Workarounds\n\n- Disable PROXY protocol v1 parsing if it is not required:\n\n ```ruby\n   # remove/comment this:\n   # set_remote_address proxy_protocol: :v1\n ```\n\n - Restrict direct network access to Puma listeners using PROXY protocol:\n     - Only allow trusted load balancers/reverse proxies to connect.\n     - Block arbitrary client TCP access with firewall/security group rules.\n\n### Resources\n- [HAProxy PROXY protocol specification](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)\n- [CWE-400: Uncontrolled Resource Consumption](https://cwe.mitre.org/data/definitions/400.html)\n- [CWE-770: Allocation of Resources Without Limits or Throttling](https://cwe.mitre.org/data/definitions/770.html)\n- [Puma `set_remote_address` documentation](https://github.com/puma/puma/blob/master/lib/puma/dsl.rb)\n- [Puma client PROXY protocol parsing code](https://github.com/puma/puma/blob/master/lib/puma/client.rb)\n- [Puma constants, including `PROXY_PROTOCOL_V1_REGEX`](https://github.com/puma/puma/blob/master/lib/puma/const.rb)","summary":"Puma buffers incoming bytes without limit while waiting for a PROXY protocol v1 line terminated by CRLF. A single unauthenticated TCP connection that never sends CRLF can grow memory without bound and drive CPU cost, causing process or container out-of-memory crashes.","severity":"high","cvss":7.5,"epss":0.00346,"exploited":false,"exploited_at":null,"products":[{"name":"puma","fixed":["8.0.2"],"affected":">= 8.0.0, < 8.0.2","ecosystem":"rubygems"},{"name":"puma","fixed":["7.2.1"],"affected":">= 5.5.0, < 7.2.1","ecosystem":"rubygems"}],"ecosystems":["rubygems"],"tags":["cwe-400","puma","rails","ruby","runtime","self-hosted"],"not_affected_if":["default-config","firewalled-listeners","puma-not-on-proxy-protocol-v1"],"how_to_check":"- Check the Puma version in the Gemfile.lock, e.g. `bundle exec puma --version`, and compare against the affected ranges.\n- Search the Puma config (config/puma.rb) for `set_remote_address proxy_protocol: :v1`; only this non-default setting is affected.","fix":"- rubygems:puma `>= 8.0.0, < 8.0.2`: upgrade to `8.0.2`\n- rubygems:puma `>= 5.5.0, < 7.2.1`: upgrade to `7.2.1`","status":"open","published_at":"2026-06-08T23:55:44+00:00","first_seen_at":"2026-11-02T22:13:20+00:00","triaged_at":"2026-11-02T22:14:46+00:00","updated_at":"2026-11-02T22:14:46+00:00","category":"runtime","confidence":0.9,"triage":{"at":"2026-11-02T22:14:46Z","model":"claude-haiku-5-5","output":{"fix":"- rubygems:puma `>= 8.0.0, < 8.0.2`: upgrade to `8.0.2`\n- rubygems:puma `>= 5.5.0, < 7.2.1`: upgrade to `7.2.1`","reach":"internet","title":"Puma: unauthenticated connection can exhaust server memory via PROXY v1","impact":"medium","summary":"Puma buffers incoming bytes without limit while waiting for a PROXY protocol v1 line terminated by CRLF. A single unauthenticated TCP connection that never sends CRLF can grow memory without bound and drive CPU cost, causing process or container out-of-memory crashes.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ruby","puma","rails","self-hosted"],"confidence":0.9,"fix_status":"available","needs_auth":"no","worst_case":"remote unauthenticated attacker exhausts memory, crashing the process or container","analyst_note":"","how_to_check":"- Check the Puma version in the Gemfile.lock, e.g. `bundle exec puma --version`, and compare against the affected ranges.\n- Search the Puma config (config/puma.rb) for `set_remote_address proxy_protocol: :v1`; only this non-default setting is affected.","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","puma-not-on-proxy-protocol-v1","firewalled-listeners"],"who_is_affected":"Only Puma servers with PROXY protocol v1 parsing enabled through `set_remote_address proxy_protocol: :v1` are exposed; default configurations are not. Teams that run Puma behind a load balancer and accept direct client connections on the Puma port are the most exposed, and deployments where only trusted proxies can reach Puma can skip the urgent change.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000835,"input_tokens":4987,"output_tokens":672,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,19A '-400':24B,264C '-47736':12A,20A '-770':272C '/data/definitions/400.html)':270C '/data/definitions/770.html)':282C '/download/1.8/doc/proxy-protocol.txt)':262C '/puma/puma/blob/master/lib/puma/client.rb)':299C '/puma/puma/blob/master/lib/puma/const.rb)':309C '/puma/puma/blob/master/lib/puma/dsl.rb)':290C '/puma/puma/issues/2651)':84C '5.5.0':89C '7.2.1':205C '8.0.2':207C '93vx':16A 'access':231C,250C 'add':86C 'addit':151C 'address':195C,224C,286C 'affect':191C 'alloc':273C 'allow':6A,239C 'append':134C 'arbitrari':247C 'attack':121C 'avail':179C 'balancers/reverse':242C 'block':246C 'bound':62B 'buffer':33B,104C,140C,159C 'byte':35B,100C,129C 'caus':67B,143C,174C 'client':248C,292C 'code':296C 'config':189C 'connect':53B,125C,166C,245C 'constant':301C 'consumpt':267C 'contain':70B 'continu':127C 'cost':66B,153C 'cpu':65B,152C 'crash':75B 'crlf':48B,57B,131C,161C 'cve':10A,18A 'cwe':23B,263C,271C 'cwe.mitre.org':269C,281C 'cwe.mitre.org/data/definitions/400.html)':268C 'cwe.mitre.org/data/definitions/770.html)':280C 'default':188C 'degrad':178C 'determin':111C 'direct':229C 'disabl':209C 'document':287C 'drive':64B,168C 'enabl':96C 'exhaust':9A 'firewall/security':252C 'follow':185C 'g8v8':17A 'ghsa':14A 'ghsa-qpgp-93vx-g8v8':13A 'github.com':83C,289C,298C,308C 'github.com/puma/puma/blob/master/lib/puma/client.rb)':297C 'github.com/puma/puma/blob/master/lib/puma/const.rb)':307C 'github.com/puma/puma/blob/master/lib/puma/dsl.rb)':288C 'github.com/puma/puma/issues/2651)':82C 'group':253C 'grow':59B,158C 'growth':149C,171C 'haproxi':256C 'host':31B 'impact':76C 'in-process':145C 'includ':302C 'incom':34B,99C 'intern':103C 'keep':133C 'limit':37B,277C 'line':45B,116C 'listen':234C 'load':241C 'may':173C 'memori':8A,60B,74B,148C,170C 'n':109C 'network':230C 'never':55B 'non':187C 'non-default':186C 'oom':176C 'open':122C 'out-of-memori':71B 'pars':139C,213C,295C 'parser':5A 'patch':199C 'pre':138C 'pre-pars':137C 'present':118C 'process':68B,147C 'process/container':175C 'protocol':3A,43B,78C,92C,197C,211C,226C,237C,258C,294C,304C 'proxi':2A,42B,77C,91C,114C,196C,210C,225C,236C,243C,257C,293C,303C 'puma':1A,21A,22A,25B,32B,81C,97C,132C,181C,233C,283C,291C,300C 'qpgp':15A 'r':108C 'rail':26B 'read':98C 'regex':306C 'remot':7A,194C,223C,285C 'remove/comment':220C 'repeat':155C 'requir':218C 'resourc':255C,266C,275C 'restrict':228C 'rubi':27B,192C,219C 'rule':254C 'runtim':28B 'scan':156C 'self':30B 'self-host':29B 'send':56B,128C 'server':182C 'set':193C,222C,284C 'signific':169C 'singl':50B,163C 'specif':259C 'support':79C,94C 'tcp':52B,124C,165C,249C 'termin':46B 'throttl':279C 'trust':240C 'unauthent':51B,164C 'unbound':144C 'uncontrol':265C 'upgrad':202C 'use':183C,235C 'user':200C 'v1':4A,44B,93C,115C,198C,212C,227C,305C 'version':88C,204C 'wait':39B,106C 'whether':112C 'without':36B,61B,130C,276C 'workaround':208C 'www.haproxy.org':261C 'www.haproxy.org/download/1.8/doc/proxy-protocol.txt)':260C","nicknames":[],"mitigations":[],"who_affected":"Only Puma servers with PROXY protocol v1 parsing enabled through `set_remote_address proxy_protocol: :v1` are exposed; default configurations are not. Teams that run Puma behind a load balancer and accept direct client connections on the Puma port are the most exposed, and deployments where only trusted proxies can reach Puma can skip the urgent change.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["puma"],"ptokens":["puma"],"labels":["cwe400","high","puma","rails","ruby","rubygems","runtime","selfhosted"],"first_public_at":"2026-05-27T00:19:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-qpgp-93vx-g8v8","url":"https://github.com/advisories/GHSA-qpgp-93vx-g8v8","severity":"high","published_at":"2026-06-08T23:55:44+00:00","modified_at":"2026-11-02T22:10:05+00:00","first_seen_at":"2026-11-02T22:13:20+00:00","fetched_at":"2026-11-02T23:04:40+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-47736","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47736","severity":null,"published_at":"2026-07-14T20:17:03+00:00","modified_at":"2026-07-15T18:15:13+00:00","first_seen_at":"2026-11-02T22:35:43+00:00","fetched_at":"2026-11-02T22:35:43+00:00","note":null}],"documents":[{"id":54112,"url":"https://api.github.com/repos/puma/puma/security-advisories/GHSA-qpgp-93vx-g8v8","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":54113,"url":"https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-05-27T00:19:41+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":54114,"url":"https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":54115,"url":"https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":54116,"url":"https://github.com/puma/puma/releases/tag/v7.2.1","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":54117,"url":"https://github.com/puma/puma/releases/tag/v8.0.2","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}