CVE-2026-47737 puma CVE debrief

Who should care

Deployments that explicitly enable PROXY protocol v1 and have set `set_remote_address proxy_protocol: :v1` should assess exposure and verify configuration. This includes operators, platform administrators, and security teams responsible for managing and securing Puma deployments. They should review the configuration and assess the potential impact of this vulnerability on their systems.

Why it matters

This vulnerability allows source IP spoofing in Puma deployments that enable PROXY protocol v1 and use persistent connections. It can compromise security decisions, rate limiting, auditing, and allow/deny lists that rely on `REMOTE_ADDR`.

• Source IP spoofing can mislead applications or middleware that use `REMOTE_ADDR` for security decisions
• Rate limiting and auditing mechanisms may be bypassed or inaccurate
• Allow/deny lists may be circumvented
• Security decisions based on `REMOTE_ADDR` may be compromised

Technical summary

Puma incorrectly re-parsed PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite `REMOTE_ADDR`. This vulnerability affects deployments that explicitly enable PROXY protocol v1 and have set `set_remote_address proxy_protocol: :v1`. Puma's default configuration and deployments that do not use persistent connections are not expected to be affected. The vulnerability allows source IP spoofing, which can mislead applications or middleware that use `REMOTE_ADDR` for security decisions, rate limiting, auditing, or allow/deny lists.

Defensive priority

Upgrade to a fixed version, verify configuration, and monitor for suspicious activity

Recommended defensive actions

• Upgrade to version 8.0.2 or later
• Verify that `set_remote_address proxy_protocol: :v1` is not enabled in configuration
• Monitor for suspicious activity and review application security decisions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability allows an attacker to inject a second PROXY header between HTTP requests, which can mislead applications or middleware that use `REMOTE_ADDR` for security decisions, rate limiting, auditing, or allow/deny lists.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.