CVE-2026-47737 Details
Description
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2.
A vulnerability in Puma, a Ruby/Rack web server, allows for source IP spoofing when PROXY protocol v1 is enabled and persistent connections are used. This issue affects Puma versions 5.5.0 prior to 7.2.1 and 8.0.2. The vulnerability arises because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection. An attacker could inject a second PROXY header, overwriting the REMOTE_ADDR variable. This misconfiguration can lead to security issues, as applications may rely on REMOTE_ADDR for security decisions, rate limiting, or auditing.
Users should upgrade to Puma versions 7.2.1 or 8.0.2. If PROXY protocol v1 is not needed, it can be disabled by removing or commenting out the 'set_remote_address proxy_protocol: :v1' line in the configuration. Alternatively, users can disable persistent connections to Puma.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 14, 2026CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f | [email protected] | Source CodeVendor |
| https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58 | [email protected] | Source CodeVendor |
| https://github.com/puma/puma/pull/3944 | [email protected] | Issue TrackingVendor |
| https://github.com/puma/puma/pull/3947 | [email protected] | Issue TrackingVendor |
| https://github.com/puma/puma/releases/tag/v7.2.1 | [email protected] | AdvisoryRelease NotesVendor |
| https://github.com/puma/puma/releases/tag/v8.0.2 | [email protected] | Release NotesVendor |
| https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Puma | >= 5.5.0, < 8.0.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |