CVE-2026-47736 | Puma is a Ruby/Rack web server built for parallelism. From 5… | CVSS 7.5 HIGH

Description

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends bytes without CRLF to cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer. This issue is fixed in versions 7.2.1 and 8.0.2.

Metadata

CVE ID: CVE-2026-47736
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-05-19 22:16 UTC
Published: 2026-07-14 19:54 UTC
Last updated: 2026-07-14 19:54 UTC
Primary CWE: CWE-400
CWE-400: Uncontrolled Resource Consumption
Vendor / Product: puma / puma
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products (1)

Vendor	Product	Platform	Versions
puma	puma	—	>= 5.5.0, < 7.2.1, >= 8.0.0, < 8.0.2

Weakness (CWE)

CWE	Source	Description
CWE-400	cna	CWE-400: Uncontrolled Resource Consumption

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (5)

https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8 https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8
https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f
https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58 https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58
https://github.com/puma/puma/releases/tag/v7.2.1 https://github.com/puma/puma/releases/tag/v7.2.1
https://github.com/puma/puma/releases/tag/v8.0.2 https://github.com/puma/puma/releases/tag/v8.0.2