CVE-2026-47736
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A vulnerability in Puma (versions 5.5.0 through 7.2.1 and 8.0.2) with PROXY protocol v1 support enabled allows an attacker to continuously send bytes without CRLF, causing unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer.
Risk Assessment
The organization risks memory exhaustion and performance degradation, potentially leading to denial of service (DoS) and application downtime.
Recommendation
Immediately upgrade Puma to version 7.2.1 or 8.0.2, which contain the fix for this vulnerability.
Other vulnerabilities in Puma
See all- CVE-2026-47737High
Puma versions 5.5.0 through 7.2.1 and 8.0.2 are vulnerable to source IP spoofing. When proxy_protocol: :v1 is enabled and persistent connections are used, Puma incorrectly re-parses PROXY headers after each keep-alive request, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR.
- CVE-2023-40175High
Puma, a Ruby/Rack web server, prior to versions 6.3.1 and 5.6.7, exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers, allowing for HTTP request smuggling.
Original NVD description (English source)
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends bytes without CRLF to cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer. This issue is fixed in versions 7.2.1 and 8.0.2.