High severity7.5NVD Advisory· Published Jul 14, 2026· Updated Jul 15, 2026
CVE-2026-47737
CVE-2026-47737
Description
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
pumaRubyGems | >= 8.0.0, < 8.0.2 | 8.0.2 |
pumaRubyGems | >= 5.5.0, < 7.2.1 | 7.2.1 |
Affected products
24- osv-coords23 versionspkg:apk/chainguard/gitlab-exporter-18.10pkg:apk/chainguard/gitlab-exporter-18.11pkg:apk/chainguard/gitlab-exporter-19.0pkg:apk/chainguard/gitlab-exporter-19.1pkg:apk/chainguard/gitlab-rails-ce-18.10pkg:apk/chainguard/gitlab-rails-ce-18.11pkg:apk/chainguard/gitlab-rails-ce-19.0pkg:apk/chainguard/gitlab-rails-ce-fips-18.10pkg:apk/chainguard/gitlab-rails-ce-fips-18.11pkg:apk/chainguard/gitlab-rails-ce-fips-19.0pkg:apk/chainguard/logstash-8.19pkg:apk/chainguard/logstash-8.19-iamguarded-compatpkg:apk/chainguard/logstash-8.19-with-output-opensearchpkg:apk/chainguard/logstash-9.3pkg:apk/chainguard/logstash-9.3-iamguarded-compatpkg:apk/chainguard/logstash-9.4pkg:apk/chainguard/logstash-9.4-iamguarded-compatpkg:apk/chainguard/logstash-fips-9.4pkg:apk/chainguard/logstash-fips-9.4-iamguarded-compatpkg:apk/wolfi/logstash-9.3pkg:apk/wolfi/logstash-9.3-iamguarded-compatpkg:apk/wolfi/logstash-9.4pkg:apk/wolfi/logstash-9.4-iamguarded-compat
< 18.10.8-r1+ 22 more
- (no CPE)range: < 18.10.8-r1
- (no CPE)range: < 18.11.6-r2
- (no CPE)range: < 19.0.0-r2
- (no CPE)range: < 19.1.1-r1
- (no CPE)range: < 18.10.8-r1
- (no CPE)range: < 18.11.5-r1
- (no CPE)range: < 19.0.2-r1
- (no CPE)range: < 18.10.8-r1
- (no CPE)range: < 18.11.5-r1
- (no CPE)range: < 19.0.1-r5
- (no CPE)range: < 8.19.18-r0
- (no CPE)range: < 8.19.18-r0
- (no CPE)range: < 8.19.18-r0
- (no CPE)range: < 9.3.7-r0
- (no CPE)range: < 9.3.7-r0
- (no CPE)range: < 9.4.4-r0
- (no CPE)range: < 9.4.4-r0
- (no CPE)range: < 9.4.4-r0
- (no CPE)range: < 9.4.4-r0
- (no CPE)range: < 9.3.7-r0
- (no CPE)range: < 9.3.7-r0
- (no CPE)range: < 9.4.4-r0
- (no CPE)range: < 9.4.4-r0
Patches
Vulnerability mechanics
References
10- github.com/advisories/GHSA-2vqw-3mp8-cgmxghsaADVISORY
- github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmxnvdWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2026-47737.ymlghsaWEB
- www.cve.org/CVERecord/SearchResultsghsaWEB
- github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889fnvd
- github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58nvd
- github.com/puma/puma/pull/3944nvd
- github.com/puma/puma/pull/3947nvd
- github.com/puma/puma/releases/tag/v7.2.1nvd
- github.com/puma/puma/releases/tag/v8.0.2nvd
News mentions
0No linked articles in our index yet.