CVE-2026-47736 Details
Description
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends bytes without CRLF to cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer. This issue is fixed in versions 7.2.1 and 8.0.2.
A vulnerability in the Puma web server, affecting versions 5.5.0 prior to 7.2.1 and 8.0.2, allows for remote memory exhaustion when PROXY protocol v1 support is enabled. The server reads incoming data into an internal buffer, waiting for a carriage return and line feed (CRLF) to identify PROXY v1 lines. An attacker can exploit this by sending bytes without CRLF, causing unbounded memory growth and increased CPU usage as the server scans the expanding buffer. This issue can lead to out-of-memory conditions or degraded availability.
Users should upgrade to Puma versions 7.2.1 or 8.0.2. If the PROXY protocol v1 parsing is not needed, it can be disabled by removing or commenting out the 'set_remote_address proxy_protocol: :v1' line in the server configuration. For added security, restrict direct network access to Puma listeners using PROXY protocol, allowing only trusted load balancers or reverse proxies to connect and blocking arbitrary client TCP access with firewall or security group rules.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 14, 2026CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f | [email protected] | Source CodeVendor |
| https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58 | [email protected] | Source CodeVendor |
| https://github.com/puma/puma/releases/tag/v7.2.1 | [email protected] | Release NotesVendor |
| https://github.com/puma/puma/releases/tag/v8.0.2 | [email protected] | Release NotesVendor |
| https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Puma | >= 5.5.0, < 8.0.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |