Junglewise Threat Intelligence

CVE-2026-47737: Puma source IP spoofing via PROXY protocol injection

CVE-2026-47737 · Severity: high · CVSS 7.5 · Published 2026-07-14

Technologies: Puma.

Executive brief

Puma is a popular web server used to run Ruby applications. A vulnerability in how it handles certain network proxy settings allows an attacker to fake their original IP address. This could allow unauthorized users to bypass security filters, skip rate limits, or hide their identity in activity logs, potentially leading to unauthorized access or undetected malicious activity.

Technical details

Puma is vulnerable to source IP spoofing when the PROXY protocol v1 is enabled via 'set_remote_address proxy_protocol: :v1'. The root cause is that Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on a persistent connection, rather than only once at the start of the TCP connection. An attacker can inject a second PROXY header between HTTP requests, which Puma then treats as authoritative, overwriting the 'REMOTE_ADDR' variable. This allows for the bypass of security mechanisms that rely on source IP verification, such as IP-based allow-lists or rate limiting. The issue is fixed in versions 7.2.1 and 8.0.2.

Affected products

  • Puma Puma >= 5.5.0, < 7.2.1; >= 8.0.0, < 8.0.2

Timeline

  • 2026-05-26: patched: Fixes merged into stable branches
  • 2026-05-27: advisory: GitHub Security Advisory published
  • 2026-07-14: disclosed: CVE published to NVD

References