Skip to content

Commit fc8b8a1

Browse files
jasnowRubySec CI
jasnow
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@258cd38 
1 parent c456e76 commit fc8b8a1

2 files changed

Lines changed: 139 additions & 0 deletions

File tree

‎advisories/_posts/2026-05-27-CVE-2026-47736.md‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-47736 (puma): Puma PROXY Protocol v1 Parser Allows Remote Memory
4+
Exhaustion'
5+
comments: false
6+
categories:
7+
- puma
8+
advisory:
9+
gem: puma
10+
cve: 2026-47736
11+
ghsa: qpgp-93vx-g8v8
12+
url: https://www.cve.org/CVERecord?id=CVE-2026-47736
13+
title: Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion
14+
date: 2026-05-27
15+
description: |-
16+
## Impact
17+
18+
PROXY protocol support for Puma was added in version 5.5.0.
19+
20+
When PROXY protocol v1 support is enabled, Puma reads incoming bytes
21+
into an internal buffer. It waits for "\r\n" to determine whether a
22+
PROXY v1 line is present. If an attacker opens a TCP connection and
23+
continuously sends bytes without CRLF, Puma keeps appending to this
24+
pre-parse buffer.
25+
26+
This can cause unbounded in-process memory growth and additional
27+
CPU cost from repeatedly scanning the growing buffer for CRLF.
28+
A single, unauthenticated TCP connection can drive significant memory
29+
growth and may cause process/container OOM or degraded availability.
30+
31+
Only Puma servers using the following non-default config are affected:
32+
33+
set_remote_address proxy_protocol: :v1
34+
35+
## Workarounds
36+
37+
* Disable PROXY protocol v1 parsing if it is not required:
38+
# remove/comment this:
39+
# set_remote_address proxy_protocol: :v1
40+
41+
* Restrict direct network access to Puma listeners using PROXY protocol:
42+
* Only allow trusted load balancers/reverse proxies to connect.
43+
* Block arbitrary client TCP access with firewall/security group rules.
44+
cvss_v3: 7.5
45+
unaffected_versions:
46+
- "< 5.5.0"
47+
patched_versions:
48+
- "~> 7.2.1"
49+
- ">= 8.0.2"
50+
related:
51+
url:
52+
- https://www.cve.org/CVERecord?id=CVE-2026-47736
53+
- https://rubygems.org/gems/puma/versions/8.0.2
54+
- https://github.com/puma/puma/releases/tag/v8.0.2
55+
- https://github.com/puma/puma/releases/tag/v7.2.1
56+
- https://github.com/puma/puma/blob/main/History.md#802--2026-05-27
57+
- https://github.com/puma/puma/blob/main/History.md#721--2026-05-27
58+
- https://github.com/puma/puma/pull/2654
59+
- https://github.com/puma/puma/issues/2651
60+
- https://rubyweekly.com/issues/803
61+
- https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8
62+
notes: |
63+
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-47736 (reserved)
64+
- No nvd cvss values
65+
---

‎advisories/_posts/2026-05-27-CVE-2026-47737.md‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-47737 (puma): Puma PROXY Protocol v1 Accepts Repeated Protocol Headers
4+
on Persistent Connections'
5+
comments: false
6+
categories:
7+
- puma
8+
advisory:
9+
gem: puma
10+
cve: 2026-47737
11+
ghsa: 2vqw-3mp8-cgmx
12+
url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-47737
13+
title: Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections
14+
date: 2026-05-27
15+
description: |-
16+
## Impact
17+
18+
Puma is vulnerable to source IP spoofing when set_remote_address
19+
proxy_protocol: :v1 is enabled and persistent connections are used.
20+
21+
PROXY protocol v1 is a connection-level protocol. Support was added
22+
to Puma in v5.5.0. A proxy sends one PROXY header at the beginning
23+
of a TCP connection, before any HTTP data. Puma incorrectly re-parsed
24+
PROXY protocol headers after each keep-alive request on the same
25+
connection. An attacker able to send HTTP requests through a trusted
26+
proxy could therefore inject a second PROXY header between HTTP
27+
requests. Puma would treat the injected header as authoritative for
28+
the next request and overwrite REMOTE_ADDR.
29+
30+
This can mislead applications or middleware that use REMOTE_ADDR for
31+
security decisions, rate limiting, auditing, or allow/deny lists.
32+
33+
Only deployments that explicitly enable PROXY protocol v1 are affected,
34+
and will have set:
35+
36+
set_remote_address proxy_protocol: :v1
37+
38+
Puma's default configuration is not affected. Deployments that do
39+
not use persistent connections to Puma are also not expected to
40+
be affected by this issue.
41+
42+
## Workarounds
43+
44+
* Disable PROXY protocol v1 parsing if it is not required:
45+
46+
# remove/comment this:
47+
# set_remote_address proxy_protocol: :v1
48+
49+
Users can also disable persistent connections to Puma, for example:
50+
51+
enable_keep_alives false
52+
cvss_v3: 7.5
53+
unaffected_versions:
54+
- "< 5.5.0"
55+
patched_versions:
56+
- "~> 7.2.1"
57+
- ">= 8.0.2"
58+
related:
59+
url:
60+
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-47737
61+
- https://rubygems.org/gems/puma/versions/8.0.2
62+
- https://github.com/puma/puma/blob/main/History.md#802--2026-05-27
63+
- https://github.com/puma/puma/blob/main/History.md#721--2026-05-27
64+
- https://github.com/puma/puma/releases/tag/v8.0.2
65+
- https://github.com/puma/puma/releases/tag/v7.2.1
66+
- https://github.com/puma/puma/pull/2654
67+
- https://github.com/phires/go-guerrilla/security/advisories/GHSA-c2c3-pqw5-5p7c
68+
- https://github.com/puma/puma/issues/2651
69+
- https://rubyweekly.com/issues/803
70+
- https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx
71+
notes: |
72+
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-47737 (reserved)
73+
- No nvd cvss values
74+
---

0 commit comments

Comments
 (0)