High severity7.5NVD Advisory· Published Jul 14, 2026· Updated Jul 15, 2026
CVE-2026-47736
CVE-2026-47736
Description
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends bytes without CRLF to cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer. This issue is fixed in versions 7.2.1 and 8.0.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
pumaRubyGems | >= 8.0.0, < 8.0.2 | 8.0.2 |
pumaRubyGems | >= 5.5.0, < 7.2.1 | 7.2.1 |
Affected products
24- osv-coords23 versionspkg:apk/chainguard/gitlab-exporter-18.10pkg:apk/chainguard/gitlab-exporter-18.11pkg:apk/chainguard/gitlab-exporter-19.0pkg:apk/chainguard/gitlab-exporter-19.1pkg:apk/chainguard/gitlab-rails-ce-18.10pkg:apk/chainguard/gitlab-rails-ce-18.11pkg:apk/chainguard/gitlab-rails-ce-19.0pkg:apk/chainguard/gitlab-rails-ce-fips-18.10pkg:apk/chainguard/gitlab-rails-ce-fips-18.11pkg:apk/chainguard/gitlab-rails-ce-fips-19.0pkg:apk/chainguard/logstash-8.19pkg:apk/chainguard/logstash-8.19-iamguarded-compatpkg:apk/chainguard/logstash-8.19-with-output-opensearchpkg:apk/chainguard/logstash-9.3pkg:apk/chainguard/logstash-9.3-iamguarded-compatpkg:apk/chainguard/logstash-9.4pkg:apk/chainguard/logstash-9.4-iamguarded-compatpkg:apk/chainguard/logstash-fips-9.4pkg:apk/chainguard/logstash-fips-9.4-iamguarded-compatpkg:apk/wolfi/logstash-9.3pkg:apk/wolfi/logstash-9.3-iamguarded-compatpkg:apk/wolfi/logstash-9.4pkg:apk/wolfi/logstash-9.4-iamguarded-compat
< 18.10.8-r1+ 22 more
- (no CPE)range: < 18.10.8-r1
- (no CPE)range: < 18.11.6-r2
- (no CPE)range: < 19.0.0-r2
- (no CPE)range: < 19.1.1-r1
- (no CPE)range: < 18.10.8-r1
- (no CPE)range: < 18.11.5-r1
- (no CPE)range: < 19.0.2-r1
- (no CPE)range: < 18.10.8-r1
- (no CPE)range: < 18.11.5-r1
- (no CPE)range: < 19.0.1-r5
- (no CPE)range: < 8.19.18-r0
- (no CPE)range: < 8.19.18-r0
- (no CPE)range: < 8.19.18-r0
- (no CPE)range: < 9.3.7-r0
- (no CPE)range: < 9.3.7-r0
- (no CPE)range: < 9.4.4-r0
- (no CPE)range: < 9.4.4-r0
- (no CPE)range: < 9.4.4-r0
- (no CPE)range: < 9.4.4-r0
- (no CPE)range: < 9.3.7-r0
- (no CPE)range: < 9.3.7-r0
- (no CPE)range: < 9.4.4-r0
- (no CPE)range: < 9.4.4-r0
Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-qpgp-93vx-g8v8ghsaADVISORY
- github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8nvdWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2026-47736.ymlghsaWEB
- www.cve.org/CVERecordghsaWEB
- github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889fnvd
- github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58nvd
- github.com/puma/puma/releases/tag/v7.2.1nvd
- github.com/puma/puma/releases/tag/v8.0.2nvd
News mentions
0No linked articles in our index yet.