Back to overview

CVE-2026-47737

HIGH
7.5
CVSS 3.1
Description
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2.

Metadata

CVE ID
CVE-2026-47737
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-05-19 22:16 UTC
Published
2026-07-14 19:45 UTC
Last updated
2026-07-14 19:45 UTC
Primary CWE
CWE-290
CWE-290: Authentication Bypass by Spoofing
Vendor / Product
puma / puma
Sources
cve.org  ·  NVD

Severity & Metrics

7.5 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products (1)
VendorProductPlatformVersions
puma puma — >= 5.5.0, < 7.2.1, >= 8.0.0, < 8.0.2
Weakness (CWE)
CWESourceDescription
CWE-290 cna CWE-290: Authentication Bypass by Spoofing
CWE-345 cna CWE-345: Insufficient Verification of Data Authenticity
CVSS scores (1)
ScoreSeverityVersionSourceVector
7.5 HIGH 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References (7)
Back to overview