CVE-2026-47736

Deferred Deferred - Pending Action

Memory Exhaustion in Puma Web Server via PROXY Protocol

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends bytes without CRLF to cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer. This issue is fixed in versions 7.2.1 and 8.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-47736

Affected Vendors & Products

Vendor	Product	Version / Range
puma	puma	From 5.5.0 (inc) to 7.2.1 (inc)
puma	puma	7.2.1
puma	puma	8.0.2
puma	puma	From 5.5.0 (inc) to 8.0.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

CVE-2026-47736 is a memory exhaustion vulnerability in Puma's PROXY Protocol v1 parser. When enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to detect a PROXY v1 line. An attacker sending continuous bytes without CRLF causes unbounded memory growth and increased CPU usage.

Detection Guidance

Check if your Puma server is running a vulnerable version (5.5.0 to 8.0.1) with PROXY protocol v1 enabled. Use commands like 'puma --version' to verify the version. Monitor for unusual memory or CPU usage spikes, especially on systems handling PROXY protocol traffic.

Impact Analysis

This vulnerability can lead to denial-of-service conditions by consuming excessive memory and CPU resources. It may cause application crashes, degraded performance, or container failures due to out-of-memory errors. Exploitation requires no privileges or user interaction.

Mitigation Strategies

Upgrade Puma to version 7.2.1 or 8.0.2 or later. If PROXY protocol v1 is not required, disable it by removing the 'set_remote_address proxy_protocol: :v1' configuration. Restrict network access to trusted load balancers only.

Hi! I’m here to help you understand CVE-2026-47736. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70