CVE-2026-47736 puma CVE debrief

Who should care

Defenders responsible for Puma servers using the non-default PROXY protocol v1 config should assess exposure and prioritize upgrading or disabling the protocol to prevent potential memory exhaustion attacks.

Why it matters

CVE-2026-47736 is a vulnerability in Puma's PROXY protocol v1 parser that can cause memory exhaustion attacks. Defenders should prioritize upgrading or disabling the protocol to prevent potential attacks.

• Memory exhaustion attacks can lead to process/container OOM or degraded availability
• Unauthenticated TCP connections can cause significant memory growth
• Upgrade or configuration changes are required to mitigate the vulnerability

Technical summary

When PROXY protocol v1 support is enabled in Puma, an attacker can cause unbounded in-process memory growth by continuously sending bytes without CRLF, potentially leading to process/container OOM or degraded availability. The vulnerability affects Puma versions prior to 7.2.1 or 8.0.2. Defenders should prioritize upgrading Puma to versions 7.2.1 or 8.0.2, or disabling PROXY protocol v1 parsing if not required, to prevent potential memory exhaustion attacks. The vulnerability was introduced in Puma version 5.5.0 and affects servers using the non-default PROXY protocol v1 config.

Defensive priority

Defenders should prioritize upgrading Puma to versions 7.2.1 or 8.0.2, or disabling PROXY protocol v1 parsing if not required, to prevent potential memory exhaustion attacks.

Recommended defensive actions

• Upgrade Puma to version 7.2.1 or 8.0.2
• Disable PROXY protocol v1 parsing if not required
• Restrict direct network access to Puma listeners using PROXY protocol
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected configurations and recommended patches. However, the CVSS score and severity are not provided. The vulnerability was introduced in Puma version 5.5.0 and affects servers using the non-default PROXY protocol v1 config. Defenders should verify the presence of affected product deployments in managed environments and review official advisories for validation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.