Vulnerability-Lookup

CVE-2026-47736 (GCVE-0-2026-47736)

Vulnerability from cvelistv5 – Published: 2026-07-14 19:54 – Updated: 2026-07-15 14:28

Title

Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

Summary

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends bytes without CRLF to cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer. This issue is fixed in versions 7.2.1 and 8.0.2.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

GitHub_M

References

5 references

URL	Tags
https://github.com/puma/puma/security/advisories/…	x_refsource_CONFIRM
https://github.com/puma/puma/commit/439c6136d9c22…	x_refsource_MISC
https://github.com/puma/puma/commit/ebe9db3929ab8…	x_refsource_MISC
https://github.com/puma/puma/releases/tag/v7.2.1	x_refsource_MISC
https://github.com/puma/puma/releases/tag/v8.0.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
puma	puma	Affected: >= 5.5.0, < 7.2.1 Affected: >= 8.0.0, < 8.0.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47736",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T14:27:41.068975Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T14:28:29.155Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "puma",
          "vendor": "puma",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.5.0, \u003c 7.2.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends bytes without CRLF to cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer. This issue is fixed in versions 7.2.1 and 8.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T19:54:26.229Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8"
        },
        {
          "name": "https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f"
        },
        {
          "name": "https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58"
        },
        {
          "name": "https://github.com/puma/puma/releases/tag/v7.2.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/puma/puma/releases/tag/v7.2.1"
        },
        {
          "name": "https://github.com/puma/puma/releases/tag/v8.0.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/puma/puma/releases/tag/v8.0.2"
        }
      ],
      "source": {
        "advisory": "GHSA-qpgp-93vx-g8v8",
        "discovery": "UNKNOWN"
      },
      "title": "Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47736",
    "datePublished": "2026-07-14T19:54:26.229Z",
    "dateReserved": "2026-05-19T22:16:39.503Z",
    "dateUpdated": "2026-07-15T14:28:29.155Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-47736",
      "date": "2026-07-15",
      "epss": "0.0035",
      "percentile": "0.27221"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-47736\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-14T20:17:03.620\",\"lastModified\":\"2026-07-15T18:15:13.373\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends bytes without CRLF to cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer. This issue is fixed in versions 7.2.1 and 8.0.2.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"puma\",\"product\":\"puma\",\"versions\":[{\"version\":\"\u003e= 5.5.0, \u003c 7.2.1\",\"status\":\"affected\"},{\"version\":\"\u003e= 8.0.0, \u003c 8.0.2\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-15T14:27:41.068975Z\",\"id\":\"CVE-2026-47736\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]}],\"references\":[{\"url\":\"https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/puma/puma/releases/tag/v7.2.1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/puma/puma/releases/tag/v8.0.2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8\",\"source\":\"security-advisories@github.com\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-07-15T10:17:11+00:00",
      "cve": "CVE-2026-47736",
      "id": "CVE-2026-47736",
      "initial_release_date": "2026-07-14T19:54:26.229000+00:00",
      "product_status:known_not_affected": "19",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "puma: Puma: Denial of Service due to unbounded memory growth in PROXY protocol v1",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47736.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-400\", \"lang\": \"en\", \"description\": \"CWE-400: Uncontrolled Resource Consumption\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8\"}, {\"name\": \"https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f\"}, {\"name\": \"https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58\"}, {\"name\": \"https://github.com/puma/puma/releases/tag/v7.2.1\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/puma/puma/releases/tag/v7.2.1\"}, {\"name\": \"https://github.com/puma/puma/releases/tag/v8.0.2\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/puma/puma/releases/tag/v8.0.2\"}], \"affected\": [{\"vendor\": \"puma\", \"product\": \"puma\", \"versions\": [{\"version\": \"\u003e= 5.5.0, \u003c 7.2.1\", \"status\": \"affected\"}, {\"version\": \"\u003e= 8.0.0, \u003c 8.0.2\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-07-14T19:54:26.229Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends bytes without CRLF to cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer. This issue is fixed in versions 7.2.1 and 8.0.2.\"}], \"source\": {\"advisory\": \"GHSA-qpgp-93vx-g8v8\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-47736\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-15T14:27:41.068975Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-15T14:28:01.144Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-47736\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-05-19T22:16:39.503Z\", \"datePublished\": \"2026-07-14T19:54:26.229Z\", \"dateUpdated\": \"2026-07-15T14:28:29.155Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-47736

Vulnerability from fkie_nvd - Published: 2026-07-14 20:17 - Updated: 2026-07-15 15:16

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f
	security-advisories@github.com	https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58
	security-advisories@github.com	https://github.com/puma/puma/releases/tag/v7.2.1
	security-advisories@github.com	https://github.com/puma/puma/releases/tag/v8.0.2
	security-advisories@github.com	https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "puma",
          "vendor": "puma",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.5.0, \u003c 7.2.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.0.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends bytes without CRLF to cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer. This issue is fixed in versions 7.2.1 and 8.0.2."
    }
  ],
  "id": "CVE-2026-47736",
  "lastModified": "2026-07-15T15:16:35.157",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47736",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-15T14:27:41.068975Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-14T20:17:03.620",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/puma/puma/releases/tag/v7.2.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/puma/puma/releases/tag/v8.0.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-QPGP-93VX-G8V8

Vulnerability from github – Published: 2026-06-08 23:55 – Updated: 2026-06-08 23:55

Summary

Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

Details

Impact

PROXY protocol support for Puma was added in version 5.5.0.

When PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer. It waits for "\r\n" to determine whether a PROXY v1 line is present. If an attacker opens a TCP connection and continuously sends bytes without CRLF, Puma keeps appending to this pre-parse buffer.

This can cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer for CRLF. A single, unauthenticated TCP connection can drive significant memory growth and may cause process/container OOM or degraded availability.

Only Puma servers using the following non-default config are affected:

   set_remote_address proxy_protocol: :v1

Patches

Users should upgrade to versions 7.2.1 or 8.0.2.

Workarounds

Disable PROXY protocol v1 parsing if it is not required:

ruby # remove/comment this: # set_remote_address proxy_protocol: :v1

Restrict direct network access to Puma listeners using PROXY protocol:
- Only allow trusted load balancers/reverse proxies to connect.
- Block arbitrary client TCP access with firewall/security group rules.

Resources

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "puma"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "puma"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.5.0"
            },
            {
              "fixed": "7.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47736"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-08T23:55:44Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\n\n[PROXY protocol support for Puma](https://github.com/puma/puma/issues/2651) was added in version 5.5.0.\n\nWhen PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer. It waits for \"\\r\\n\" to determine whether a PROXY v1 line is present. If an attacker opens a TCP connection and continuously sends bytes without CRLF, Puma keeps appending to this pre-parse buffer.\n\nThis can cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer for CRLF. A single, unauthenticated TCP connection can drive significant memory growth and may cause process/container OOM or degraded availability.\n\n**Only Puma servers using the following non-default config are affected:**\n\n```ruby\n   set_remote_address proxy_protocol: :v1\n```\n\n### Patches\n\nUsers should upgrade to versions 7.2.1 or 8.0.2.\n\n### Workarounds\n\n- Disable PROXY protocol v1 parsing if it is not required:\n\n ```ruby\n   # remove/comment this:\n   # set_remote_address proxy_protocol: :v1\n ```\n\n - Restrict direct network access to Puma listeners using PROXY protocol:\n     - Only allow trusted load balancers/reverse proxies to connect.\n     - Block arbitrary client TCP access with firewall/security group rules.\n\n### Resources\n- [HAProxy PROXY protocol specification](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)\n- [CWE-400: Uncontrolled Resource Consumption](https://cwe.mitre.org/data/definitions/400.html)\n- [CWE-770: Allocation of Resources Without Limits or Throttling](https://cwe.mitre.org/data/definitions/770.html)\n- [Puma `set_remote_address` documentation](https://github.com/puma/puma/blob/master/lib/puma/dsl.rb)\n- [Puma client PROXY protocol parsing code](https://github.com/puma/puma/blob/master/lib/puma/client.rb)\n- [Puma constants, including `PROXY_PROTOCOL_V1_REGEX`](https://github.com/puma/puma/blob/master/lib/puma/const.rb)",
  "id": "GHSA-qpgp-93vx-g8v8",
  "modified": "2026-06-08T23:55:44Z",
  "published": "2026-06-08T23:55:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/puma/puma"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2026-47736.yml"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47736"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion "
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-47736 (GCVE-0-2026-47736)

FKIE_CVE-2026-47736

GHSA-QPGP-93VX-G8V8

Impact

Patches

Workarounds

Resources

Tags

Sightings

Nomenclature