Is CVE-2026-47737 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47737 being exploited in the wild.

How severe is CVE-2026-47737?

High severity, with a CVSS score of 7.5, published 14 July 2026.

Which products and versions are affected?

puma (RubyGems) ECOSYSTEM:introduced=8.0.0,fixed=8.0.2.

Is there a fix for CVE-2026-47737?

Yes. puma (RubyGems): upgrade to 8.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47737 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-47737?

Check whether you run puma (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47737: Puma source IP spoofing via PROXY protocol injection

CVE-2026-47737 · Severity: high · CVSS 7.5 · Published 2026-07-14

Puma is a popular web server used to run Ruby applications. A vulnerability in how it handles certain network proxy settings allows an attacker to fake their original IP address. This could allow unauthorized users to bypass security filters, skip rate limits, or hide their identity in activity logs, potentially leading to unauthorized access or undetected malicious activity.

Technologies: puma (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-47737 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47737 being exploited in the wild.
How severe is CVE-2026-47737?: High severity, with a CVSS score of 7.5, published 14 July 2026.
Which products and versions are affected?: puma (RubyGems) ECOSYSTEM:introduced=8.0.0,fixed=8.0.2.
Is there a fix for CVE-2026-47737?: Yes. puma (RubyGems): upgrade to 8.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47737 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-47737?: Check whether you run puma (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

puma (RubyGems): upgrade to 8.0.2 or later
```
bundle update puma
```

Technical details

Puma is vulnerable to source IP spoofing when the PROXY protocol v1 is enabled via 'set_remote_address proxy_protocol: :v1'. The root cause is that Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on a persistent connection, rather than only once at the start of the TCP connection. An attacker can inject a second PROXY header between HTTP requests, which Puma then treats as authoritative, overwriting the 'REMOTE_ADDR' variable. This allows for the bypass of security mechanisms that rely on source IP verification, such as IP-based allow-lists or rate limiting. The issue is fixed in versions 7.2.1 and 8.0.2.

Affected products

Puma Puma >= 5.5.0, < 7.2.1; >= 8.0.0, < 8.0.2

Identifiers

CVE-2026-47737
GHSA-2vqw-3mp8-cgmx

Timeline

2026-05-26: patched: Fixes merged into stable branches
2026-05-27: advisory: GitHub Security Advisory published
2026-07-14: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.