---
id: "CVE-2026-47736"
kind: "vulnerability"
aliases: ["CVE-2026-47736", "GHSA-qpgp-93vx-g8v8"]
title: "Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion"
severity: "high"
cvss: 7.5
epss: 0.00346
exploited: false
status: "open"
category: "runtime"
products: [{"name": "puma", "fixed": ["8.0.2"], "affected": ">= 8.0.0, < 8.0.2", "ecosystem": "rubygems"}, {"name": "puma", "fixed": ["7.2.1"], "affected": ">= 5.5.0, < 7.2.1", "ecosystem": "rubygems"}]
ecosystems: ["rubygems"]
tags: ["cwe-400", "puma", "rails", "ruby", "runtime", "self-hosted"]
not_affected_if: ["default-config", "firewalled-listeners", "puma-not-on-proxy-protocol-v1"]
published_at: "2026-06-08T23:55:44+00:00"
first_seen_at: "2026-11-02T22:13:20+00:00"
updated_at: "2026-11-02T22:14:46+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-qpgp-93vx-g8v8", "first_seen_at": "2026-11-02T22:13:20+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47736", "first_seen_at": "2026-11-02T22:35:43+00:00"}]
---

# Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

Puma buffers incoming bytes without limit while waiting for a PROXY protocol v1 line terminated by CRLF. A single unauthenticated TCP connection that never sends CRLF can grow memory without bound and drive CPU cost, causing process or container out-of-memory crashes.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- rubygems:puma affected >= 8.0.0, < 8.0.2 fixed 8.0.2
- rubygems:puma affected >= 5.5.0, < 7.2.1 fixed 7.2.1

## How to check

- Check the Puma version in the Gemfile.lock, e.g. `bundle exec puma --version`, and compare against the affected ranges.
- Search the Puma config (config/puma.rb) for `set_remote_address proxy_protocol: :v1`; only this non-default setting is affected.

## Fix

- rubygems:puma `>= 8.0.0, < 8.0.2`: upgrade to `8.0.2`
- rubygems:puma `>= 5.5.0, < 7.2.1`: upgrade to `7.2.1`

## Timeline

- 2026-11-02T22:13:20+00:00 ghsa https://github.com/advisories/GHSA-qpgp-93vx-g8v8
- 2026-11-02T22:35:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-47736

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/puma/puma/security-advisories/GHSA-qpgp-93vx-g8v8
- [advisory] Maintainer's advisory: github.com https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8
- [fix] Patch: github.com https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f
- [fix] Patch: github.com https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58
- [fix] Release: github.com https://github.com/puma/puma/releases/tag/v7.2.1
- [fix] Release: github.com https://github.com/puma/puma/releases/tag/v8.0.2

## From the sources

### Impact

[PROXY protocol support for Puma](https://github.com/puma/puma/issues/2651) was added in version 5.5.0.

When PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer. It waits for "\r\n" to determine whether a PROXY v1 line is present. If an attacker opens a TCP connection and continuously sends bytes without CRLF, Puma keeps appending to this pre-parse buffer.

This can cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer for CRLF. A single, unauthenticated TCP connection can drive significant memory growth and may cause process/container OOM or degraded availability.

**Only Puma servers using the following non-default config are affected:**

```ruby
   set_remote_address proxy_protocol: :v1
```

### Patches

Users should upgrade to versions 7.2.1 or 8.0.2.

### Workarounds

- Disable PROXY protocol v1 parsing if it is not required:

 ```ruby
   # remove/comment this:
   # set_remote_address proxy_protocol: :v1
 ```

 - Restrict direct network access to Puma listeners using PROXY protocol:
     - Only allow trusted load balancers/reverse proxies to connect.
     - Block arbitrary client TCP access with firewall/security group rules.

### Resources
- [HAProxy PROXY protocol specification](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)
- [CWE-400: Uncontrolled Resource Consumption](https://cwe.mitre.org/data/definitions/400.html)
- [CWE-770: Allocation of Resources Without Limits or Throttling](https://cwe.mitre.org/data/definitions/770.html)
- [Puma `set_remote_address` documentation](https://github.com/puma/puma/blob/master/lib/puma/dsl.rb)
- [Puma client PROXY protocol parsing code](https://github.com/puma/puma/blob/master/lib/puma/client.rb)
- [Puma constants, including `PROXY_PROTOCOL_V1_REGEX`](https://github.com/puma/puma/blob/master/lib/puma/const.rb)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_