CVE-2026-47737

Name of the Vulnerable Software and Affected Versions Puma versions 5.5.0 through 7.2.0 Puma versions 8.0.0 through 8.0.1

Description Puma is susceptible to source IP spoofing when persistent connections are used and the set remote address proxy protocol: :v1 configuration is enabled. The issue occurs because the server incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection. An attacker sending requests through a trusted proxy can inject a second PROXY header between HTTP requests, which Puma then treats as authoritative to overwrite the REMOTE ADDR variable. This can compromise security decisions, rate limiting, auditing, or allow/deny lists that rely on REMOTE ADDR.

Recommendations Update Puma versions 5.5.0 through 7.2.0 to version 7.2.1. Update Puma versions 8.0.0 through 8.0.1 to version 8.0.2. Disable PROXY protocol v1 parsing by removing or commenting out the set remote address proxy protocol: :v1 configuration. Disable persistent connections by setting enable keep alives false.