CVE-2026-47737CWE-290CWE-345

Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

High · published July 14, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
6.9
In the wild
Unconfirmed
What it is

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00177 · 6.9th percentile
Weaknesses
CWE-290 · Authentication Bypass by Spoofing; CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-07-14T19:45Z
EPSS history
Timeline
  • 14 JUL 19:45Z
    Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections
    cvelistv5