CVE-2026-47736
Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends bytes without CRLF to cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer. This issue is fixed in versions 7.2.1 and 8.0.2.
| CWE | CWE-400 |
| Vendor | puma |
| Product | puma |
| Published | Jul 14, 2026 |
| Last Updated | Jul 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for puma puma
Be the first to know when new high vulnerabilities affecting puma puma are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
puma / puma
>= 5.5.0, < 7.2.1 >= 8.0.0, < 8.0.2
References
github.com: https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8 github.com: https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f github.com: https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58 github.com: https://github.com/puma/puma/releases/tag/v7.2.1 github.com: https://github.com/puma/puma/releases/tag/v8.0.2