---
id: "CVE-2026-47737"
kind: "vulnerability"
aliases: ["CVE-2026-47737", "GHSA-2vqw-3mp8-cgmx"]
title: "Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections"
severity: "high"
cvss: 7.5
epss: 0.00177
exploited: false
status: "open"
category: "package"
products: [{"name": "puma", "fixed": ["8.0.2"], "affected": ">= 8.0.0, < 8.0.2", "ecosystem": "rubygems"}, {"name": "puma", "fixed": ["7.2.1"], "affected": ">= 5.5.0, < 7.2.1", "ecosystem": "rubygems"}]
ecosystems: ["rubygems"]
tags: ["cwe-290", "cwe-345", "package", "puma", "rails", "ruby", "self-hosted"]
not_affected_if: ["default-config", "no-keep-alive", "no-proxy-protocol"]
published_at: "2026-06-09T00:09:44+00:00"
first_seen_at: "2026-11-02T22:13:20+00:00"
updated_at: "2026-11-02T22:14:46+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-2vqw-3mp8-cgmx", "first_seen_at": "2026-11-02T22:13:20+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47737", "first_seen_at": "2026-11-02T22:35:43+00:00"}]
---

# Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

Puma accepted a second PROXY protocol v1 header sent on a persistent connection and overwrote REMOTE_ADDR with it. An attacker who can send requests through a trusted proxy can make applications see a forged client IP for security checks, rate limits, audit logs and allow/deny lists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- rubygems:puma affected >= 8.0.0, < 8.0.2 fixed 8.0.2
- rubygems:puma affected >= 5.5.0, < 7.2.1 fixed 7.2.1

## Fix

- puma `8.0.2` for the 8.0 line
- puma `7.2.1` for the 7.x line
- Workaround stated by the source: remove `set_remote_address proxy_protocol: :v1` if PROXY protocol v1 is not required, or set `enable_keep_alives false`.

## Timeline

- 2026-11-02T22:13:20+00:00 ghsa https://github.com/advisories/GHSA-2vqw-3mp8-cgmx
- 2026-11-02T22:35:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-47737

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/puma/puma/security-advisories/GHSA-2vqw-3mp8-cgmx
- [advisory] Maintainer's advisory: github.com https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx
- [fix] Patch: github.com https://github.com/puma/puma/pull/3944
- [fix] Patch: github.com https://github.com/puma/puma/pull/3947
- [fix] Patch: github.com https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f
- [fix] Patch: github.com https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58
- [fix] Release: github.com https://github.com/puma/puma/releases/tag/v7.2.1
- [fix] Release: github.com https://github.com/puma/puma/releases/tag/v8.0.2

## From the sources

### Impact

Puma is vulnerable to source IP spoofing when `set_remote_address proxy_protocol: :v1` is enabled and persistent connections are used.

PROXY protocol v1 is a connection-level protocol. [Support was added to Puma in v5.5.0](https://github.com/puma/puma/issues/2651). A proxy sends one PROXY header at the beginning of a TCP connection, before any HTTP data. Puma incorrectly re-parsed PROXY protocol headers after each keep-alive request on the same connection. An attacker able to send HTTP requests through a trusted proxy could therefore inject a second PROXY header between HTTP requests. Puma would treat the injected header as authoritative for the next request and overwrite `REMOTE_ADDR`.

This can mislead applications or middleware that use `REMOTE_ADDR` for security decisions, rate limiting, auditing, or allow/deny lists.

**Only deployments that explicitly enable PROXY protocol v1 are affected**, and will have set:

```ruby
set_remote_address proxy_protocol: :v1
```

Puma's default configuration is not affected. Deployments that do not use persistent connections to Puma are also not expected to be affected by this issue.

### Patches

Users should upgrade to versions 7.2.1 or 8.0.2.

### Workarounds

Disable PROXY protocol v1 parsing if it is not required:

 ```ruby
   # remove/comment this:
   # set_remote_address proxy_protocol: :v1
 ```

Users can also disable persistent connections to Puma, for example:

```ruby
enable_keep_alives false
```

### References

- [HAProxy PROXY protocol specification](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)
- [CVE-2025-31135 / GHSA-c2c3-pqw5-5p7c: go-guerrilla repeated PROXY command source IP spoofing](https://github.com/phires/go-guerrilla/security/advisories/GHSA-c2c3-pqw5-5p7c)
- [Puma `set_remote_address` documentation](https://github.com/puma/puma/blob/master/lib/puma/dsl.rb)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_