CVE-2026-47736

Name of the Vulnerable Software and Affected Versions Puma versions prior to 7.2.1 Puma versions prior to 8.0.2

Description When PROXY protocol v1 support is enabled, the server reads incoming bytes into an internal buffer and waits for a carriage return and line feed (CRLF) to identify a PROXY v1 line. An unauthenticated attacker can open a TCP connection and continuously send bytes without CRLF, causing the server to append data to the pre-parse buffer indefinitely. This leads to unbounded in-process memory growth and increased CPU consumption due to repeated scanning of the buffer, which may result in Out-of-Memory (OOM) errors or degraded availability. This issue only affects servers using the non-default configuration set remote address proxy protocol: :v1.

Recommendations Update to version 7.2.1. Update to version 8.0.2. Disable PROXY protocol v1 parsing by removing or commenting out the set remote address proxy protocol: :v1 configuration. Restrict direct network access to listeners using PROXY protocol by allowing only trusted load balancers or reverse proxies and blocking arbitrary client TCP access via firewall or security group rules.