CVE-2026-47737

Deferred Deferred - Pending Action

Puma Web Server Source IP Spoofing via PROXY Protocol

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-47737

Affected Vendors & Products

Vendor	Product	Version / Range
puma	puma	From 5.5.0 (inc) to 7.2.1 (inc)
puma	puma	From 8.0.2 (inc)
puma	puma	From 5.5.0 (inc) to 8.0.1 (inc)
puma	puma	7.2.1
puma	puma	8.0.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

Puma is a Ruby/Rack web server vulnerable to source IP spoofing when the set_remote_address proxy_protocol: :v1 option is enabled and persistent connections are used. Puma incorrectly re-parses PROXY protocol headers after each keep-alive request, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR.

Detection Guidance

Check if Puma is running with PROXY protocol v1 enabled and persistent connections by inspecting server configuration files for set_remote_address proxy_protocol: :v1. Review access logs for unusual IP addresses or multiple PROXY headers in requests. Use network monitoring tools to detect unexpected IP spoofing attempts.

Impact Analysis

This vulnerability allows an attacker to spoof their IP address, potentially bypassing security controls, misleading applications relying on REMOTE_ADDR for decisions, or evading rate limiting and access controls. It only affects systems using PROXY protocol v1 with persistent connections.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized access or data exposure if IP-based access controls are bypassed. Applications relying on REMOTE_ADDR for security decisions may fail to enforce proper restrictions, potentially violating data protection requirements.

Mitigation Strategies

Upgrade Puma to versions 7.2.1 or 8.0.2. If upgrading is not possible, disable PROXY protocol v1 parsing in the configuration or disable persistent connections. Monitor network traffic for signs of exploitation.

Hi! I’m here to help you understand CVE-2026-47737. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70