Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-14T19:54:26 puma: Puma: Denial of Service due to unbounded memory growth in PROXY protocol v1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends bytes without CRLF to cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer. This issue is fixed in versions 7.2.1 and 8.0.2.

A flaw was found in Puma, a Ruby/Rack web server. When PROXY protocol v1 support is enabled, a remote attacker can continuously send data without proper termination. This causes the server to consume an increasing amount of memory and CPU resources, leading to a Denial of Service (DoS) where the server becomes unresponsive or crashes.

This issue only affects Puma deployments that explicitly enable the non-default proxy_protocol: :v1 remote-address configuration (set_remote_address proxy_protocol: :v1). An unauthenticated network attacker able to open a TCP connection to such a listener can send bytes without a terminating CRLF, causing unbounded growth of an internal pre-parse buffer and a potential denial of service. Deployments that do not enable this configuration are not affected by this specific issue. Upgrade to Puma 7.2.1 (7.x branch) or 8.0.2 (8.x branch), whichever applies to the deployed release line. If an immediate upgrade is not possible, remove or comment out the set_remote_address proxy_protocol: :v1 configuration directive if it is not required, or restrict direct network access to the affected Puma listener to trusted load balancers or reverse proxies only. Red Hat 3scale API Management Platform 2 Not affected 3scale-amp21/backend Red Hat 3scale API Management Platform 2 Not affected 3scale-amp21/zync Red Hat 3scale API Management Platform 2 Not affected 3scale-amp22/backend Red Hat 3scale API Management Platform 2 Not affected 3scale-amp22/zync Red Hat 3scale API Management Platform 2 Not affected 3scale-amp2/backend-rhel8 Red Hat 3scale API Management Platform 2 Not affected 3scale-amp2/zync-rhel8 Red Hat 3scale API Management Platform 2 Not affected 3scale-amp2/zync-rhel9 Red Hat Enterprise Linux 10 Not affected pcs Red Hat Enterprise Linux 8 Not affected pcs Red Hat Enterprise Linux 9 Not affected pcs Red Hat Satellite 6 Not affected rubygem-puma Red Hat Satellite 6 Not affected satellite:el8/rubygem-puma https://www.cve.org/CVERecord?id=CVE-2026-47736 https://nvd.nist.gov/vuln/detail/CVE-2026-47736 https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58 https://github.com/puma/puma/releases/tag/v7.2.1 https://github.com/puma/puma/releases/tag/v8.0.2 https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8