Vulnerability-Lookup

CVE-2026-47737 (GCVE-0-2026-47737)

Vulnerability from cvelistv5 – Published: 2026-07-14 19:45 – Updated: 2026-07-15 14:10

Title

Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

Summary

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-15 14:10 UTC

CWE

CWE-290 - Authentication Bypass by Spoofing
CWE-345 - Insufficient Verification of Data Authenticity

Assigner

GitHub_M mitre root

References

7 references

URL	Tags
https://github.com/puma/puma/security/advisories/…	x_refsource_CONFIRM
https://github.com/puma/puma/pull/3944	x_refsource_MISC
https://github.com/puma/puma/pull/3947	x_refsource_MISC
https://github.com/puma/puma/commit/439c6136d9c22…	x_refsource_MISC
https://github.com/puma/puma/commit/ebe9db3929ab8…	x_refsource_MISC
https://github.com/puma/puma/releases/tag/v7.2.1	x_refsource_MISC
https://github.com/puma/puma/releases/tag/v8.0.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
puma	puma	Affected: >= 5.5.0, < 7.2.1 Affected: >= 8.0.0, < 8.0.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47737",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T14:10:11.985537Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T14:10:20.444Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "puma",
          "vendor": "puma",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.5.0, \u003c 7.2.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290: Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T19:45:16.648Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx"
        },
        {
          "name": "https://github.com/puma/puma/pull/3944",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/puma/puma/pull/3944"
        },
        {
          "name": "https://github.com/puma/puma/pull/3947",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/puma/puma/pull/3947"
        },
        {
          "name": "https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f"
        },
        {
          "name": "https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58"
        },
        {
          "name": "https://github.com/puma/puma/releases/tag/v7.2.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/puma/puma/releases/tag/v7.2.1"
        },
        {
          "name": "https://github.com/puma/puma/releases/tag/v8.0.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/puma/puma/releases/tag/v8.0.2"
        }
      ],
      "source": {
        "advisory": "GHSA-2vqw-3mp8-cgmx",
        "discovery": "UNKNOWN"
      },
      "title": "Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47737",
    "datePublished": "2026-07-14T19:45:16.648Z",
    "dateReserved": "2026-05-19T22:16:39.503Z",
    "dateUpdated": "2026-07-15T14:10:20.444Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-47737",
      "date": "2026-09-26",
      "epss": "0.00266",
      "percentile": "0.16585"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "puma",
                "vendor": "puma",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 5.5.0, \u003c 7.2.1"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 8.0.0, \u003c 8.0.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2."
          }
        ],
        "id": "CVE-2026-47737",
        "lastModified": "2026-07-15T18:15:13.373",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-47737",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T14:10:11.985537Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-14T20:17:03.767",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/puma/puma/pull/3944"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/puma/puma/pull/3947"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/puma/puma/releases/tag/v7.2.1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/puma/puma/releases/tag/v8.0.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-290"
              },
              {
                "lang": "en",
                "value": "CWE-345"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-07-15T10:16:31+00:00",
      "cve": "CVE-2026-47737",
      "id": "CVE-2026-47737",
      "initial_release_date": "2026-07-14T19:45:16.648000+00:00",
      "product_status:known_not_affected": "19",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "puma: Puma: Source IP spoofing via PROXY protocol header re-parsing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47737.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-16T17:58:32Z",
      "cve": "CVE-2026-47737",
      "id": "CVE-2026-47737",
      "initial_release_date": "2026-07-16T17:58:32Z",
      "product_status:known_affected": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-47737",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-47737.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-47737",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-15T14:10:11.985537Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-15T14:10:16.549Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "puma",
              "vendor": "puma",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 5.5.0, \u003c 7.2.1"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 8.0.0, \u003c 8.0.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-290",
                  "description": "CWE-290: Authentication Bypass by Spoofing",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-345",
                  "description": "CWE-345: Insufficient Verification of Data Authenticity",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-14T19:45:16.648Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx"
            },
            {
              "name": "https://github.com/puma/puma/pull/3944",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/puma/puma/pull/3944"
            },
            {
              "name": "https://github.com/puma/puma/pull/3947",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/puma/puma/pull/3947"
            },
            {
              "name": "https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f"
            },
            {
              "name": "https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58"
            },
            {
              "name": "https://github.com/puma/puma/releases/tag/v7.2.1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/puma/puma/releases/tag/v7.2.1"
            },
            {
              "name": "https://github.com/puma/puma/releases/tag/v8.0.2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/puma/puma/releases/tag/v8.0.2"
            }
          ],
          "source": {
            "advisory": "GHSA-2vqw-3mp8-cgmx",
            "discovery": "UNKNOWN"
          },
          "title": "Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-47737",
        "datePublished": "2026-07-14T19:45:16.648Z",
        "dateReserved": "2026-05-19T22:16:39.503Z",
        "dateUpdated": "2026-07-15T14:10:20.444Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CLEANSTART-2026-CK66622 (CVE-2026-47737)

Vulnerability from cleanstart – Published: 2026-09-18 09:49 – Updated: 2026-08-03 09:45 – Source website

Summary

Security fix for CVE-2026-47737 applied in: logstash-fips 9.4.3-r1

Details

Security vulnerability affects the logstash-fips package. This issue is resolved in later releases. See references for vulnerability details.

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2026-47737	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-47737	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "logstash-fips"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.4.3-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Security vulnerability affects the logstash-fips package. This issue is resolved in later releases. See references for vulnerability details.",
  "id": "CLEANSTART-2026-CK66622",
  "modified": "2026-08-03T09:45:51Z",
  "published": "2026-09-18T09:49:37.214484Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-CK66622.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-47737"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47737"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fix for CVE-2026-47737 applied in: logstash-fips 9.4.3-r1",
  "upstream": [
    "CVE-2026-47737"
  ]
}

CLEANSTART-2026-VR87787 (CVE-2026-55831)

Vulnerability from cleanstart – Published: 2026-08-13 12:10 – Updated: 2026-09-18 11:59 – Source website

Withdrawn 2026-09-18

Summary

Security fixes in logstash-fips 9.4.3-r1

Details

Package logstash-fips version 9.4.3-r1 fixes 76 vulnerabilities: CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-50020, CVE-2026-56746...

References

URL

Type

https://github.com/elastic/logstash

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "logstash-fips"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.4.3-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.4.3-r1"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package logstash-fips version 9.4.3-r1 fixes 76 vulnerabilities: CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-50020, CVE-2026-56746...",
  "id": "CLEANSTART-2026-VR87787",
  "modified": "2026-09-18T11:59:01.768079Z",
  "published": "2026-08-13T12:10:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/elastic/logstash"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in logstash-fips 9.4.3-r1",
  "upstream": [
    "CVE-2026-55831",
    "CVE-2026-55833",
    "CVE-2026-56745",
    "CVE-2026-50020",
    "CVE-2026-56746",
    "CVE-2026-59898",
    "CVE-2026-59899",
    "CVE-2026-59921",
    "ghsa-jppx-w49h-x2qq",
    "ghsa-6jqx-86gh-f27w",
    "ghsa-mvh2-crg5-v77c",
    "ghsa-6cqp-g7gg-8hr5",
    "ghsa-4mp9-239f-g9hg",
    "ghsa-gcjf-9mgh-3p7g",
    "ghsa-q4f6-jm68-57ww",
    "ghsa-hvcg-qmg6-jm4c",
    "CVE-2026-59901",
    "ghsa-558v-64gr-wgg4",
    "CVE-2026-54512",
    "CVE-2026-54513",
    "CVE-2026-54514",
    "CVE-2026-54515",
    "CVE-2026-59888",
    "CVE-2026-54516",
    "CVE-2026-54517",
    "CVE-2026-54518",
    "CVE-2026-59889",
    "ghsa-5gvw-p9qm-jgwh",
    "ghsa-5hh8-q8hv-fr38",
    "ghsa-rcqc-6cw3-h962",
    "ghsa-9fxm-vc8v-hj55",
    "ghsa-mhm7-754m-9p8w",
    "ghsa-j3rv-43j4-c7qm",
    "ghsa-rmj7-2vxq-3g9f",
    "ghsa-5jmj-h7xm-6q6v",
    "ghsa-3pjw-73gf-8qr5",
    "ghsa-hgj6-7826-r7m5",
    "CVE-2025-14813",
    "CVE-2026-0636",
    "CVE-2026-5598",
    "ghsa-574f-3g2m-x479",
    "ghsa-p93r-85wp-75v3",
    "ghsa-c3fc-8qff-9hwx",
    "CVE-2026-5588",
    "ghsa-wg6q-6289-32hp",
    "ghsa-r7wm-3cxj-wff9",
    "ghsa-72hv-8253-57qq",
    "CVE-2026-59949",
    "ghsa-xx22-p4ch-683r",
    "CVE-2026-47240",
    "CVE-2026-47242",
    "CVE-2026-47241",
    "ghsa-8p34-64r3-mwg8",
    "ghsa-46q3-7gv7-qmgg",
    "ghsa-c4fp-cxrr-mj66",
    "CVE-2026-47736",
    "CVE-2026-47737",
    "ghsa-qpgp-93vx-g8v8",
    "ghsa-2vqw-3mp8-cgmx",
    "CVE-2026-54906",
    "CVE-2026-54904",
    "CVE-2026-54905",
    "ghsa-h8w8-99g7-qmvj",
    "ghsa-6wx8-w4f5-wwcr",
    "ghsa-wv3x-4vxv-whpp",
    "CVE-2026-54696",
    "ghsa-x2f5-4prf-w687",
    "ghsa-5prr-v3j2-97mh",
    "ghsa-5v8h-3h3q-446p",
    "ghsa-8678-w3jw-xfc2",
    "ghsa-9cv2-cfxc-v4v2",
    "ghsa-p67v-3w7g-wjg7",
    "ghsa-phwj-rprq-35pp",
    "ghsa-wfpw-mmfh-qq69",
    "ghsa-wjv4-x9w8-wm3h",
    "ghsa-g9g8-vgvw-g3vf"
  ],
  "withdrawn": "2026-09-18T11:59:01.768079Z"
}

FKIE_CVE-2026-47737

Vulnerability from fkie_nvd - Published: 2026-07-14 20:17 - Updated: 2026-07-15 18:15

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f
	security-advisories@github.com	https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58
	security-advisories@github.com	https://github.com/puma/puma/pull/3944
	security-advisories@github.com	https://github.com/puma/puma/pull/3947
	security-advisories@github.com	https://github.com/puma/puma/releases/tag/v7.2.1
	security-advisories@github.com	https://github.com/puma/puma/releases/tag/v8.0.2
	security-advisories@github.com	https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "puma",
          "vendor": "puma",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.5.0, \u003c 7.2.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.0.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2."
    }
  ],
  "id": "CVE-2026-47737",
  "lastModified": "2026-07-15T18:15:13.373",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47737",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-15T14:10:11.985537Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-14T20:17:03.767",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/puma/puma/pull/3944"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/puma/puma/pull/3947"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/puma/puma/releases/tag/v7.2.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/puma/puma/releases/tag/v8.0.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        },
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-2VQW-3MP8-CGMX

Vulnerability from github – Published: 2026-06-09 00:09 – Updated: 2026-06-09 00:09

Summary

Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

Details

Impact

Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used.

PROXY protocol v1 is a connection-level protocol. Support was added to Puma in v5.5.0. A proxy sends one PROXY header at the beginning of a TCP connection, before any HTTP data. Puma incorrectly re-parsed PROXY protocol headers after each keep-alive request on the same connection. An attacker able to send HTTP requests through a trusted proxy could therefore inject a second PROXY header between HTTP requests. Puma would treat the injected header as authoritative for the next request and overwrite REMOTE_ADDR.

This can mislead applications or middleware that use REMOTE_ADDR for security decisions, rate limiting, auditing, or allow/deny lists.

Only deployments that explicitly enable PROXY protocol v1 are affected, and will have set:

set_remote_address proxy_protocol: :v1

Puma's default configuration is not affected. Deployments that do not use persistent connections to Puma are also not expected to be affected by this issue.

Patches

Users should upgrade to versions 7.2.1 or 8.0.2.

Workarounds

Disable PROXY protocol v1 parsing if it is not required:

ruby # remove/comment this: # set_remote_address proxy_protocol: :v1

Users can also disable persistent connections to Puma, for example:

enable_keep_alives false

References

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "puma"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "puma"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.5.0"
            },
            {
              "fixed": "7.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47737"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-290",
      "CWE-345"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-09T00:09:44Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\n\nPuma is vulnerable to source IP spoofing when `set_remote_address proxy_protocol: :v1` is enabled and persistent connections are used.\n\nPROXY protocol v1 is a connection-level protocol. [Support was added to Puma in v5.5.0](https://github.com/puma/puma/issues/2651). A proxy sends one PROXY header at the beginning of a TCP connection, before any HTTP data. Puma incorrectly re-parsed PROXY protocol headers after each keep-alive request on the same connection. An attacker able to send HTTP requests through a trusted proxy could therefore inject a second PROXY header between HTTP requests. Puma would treat the injected header as authoritative for the next request and overwrite `REMOTE_ADDR`.\n\nThis can mislead applications or middleware that use `REMOTE_ADDR` for security decisions, rate limiting, auditing, or allow/deny lists.\n\n**Only deployments that explicitly enable PROXY protocol v1 are affected**, and will have set:\n\n```ruby\nset_remote_address proxy_protocol: :v1\n```\n\nPuma\u0027s default configuration is not affected. Deployments that do not use persistent connections to Puma are also not expected to be affected by this issue.\n\n### Patches\n\nUsers should upgrade to versions 7.2.1 or 8.0.2.\n\n### Workarounds\n\nDisable PROXY protocol v1 parsing if it is not required:\n\n ```ruby\n   # remove/comment this:\n   # set_remote_address proxy_protocol: :v1\n ```\n\nUsers can also disable persistent connections to Puma, for example:\n\n```ruby\nenable_keep_alives false\n```\n\n### References\n\n- [HAProxy PROXY protocol specification](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)\n- [CVE-2025-31135 / GHSA-c2c3-pqw5-5p7c: go-guerrilla repeated PROXY command source IP spoofing](https://github.com/phires/go-guerrilla/security/advisories/GHSA-c2c3-pqw5-5p7c)\n- [Puma `set_remote_address` documentation](https://github.com/puma/puma/blob/master/lib/puma/dsl.rb)",
  "id": "GHSA-2vqw-3mp8-cgmx",
  "modified": "2026-06-09T00:09:44Z",
  "published": "2026-06-09T00:09:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/puma/puma"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2026-47737.yml"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-47737"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections"
}

UBUNTU-CVE-2026-47737 (CVE-2026-47737)

Vulnerability from osv_ubuntu – Published: 2026-07-14 20:17 – Updated: 2026-07-14 20:17 – Source website

Details

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-47737	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-47737	REPORT
	https://github.com/puma/puma/commit/439c6136d9c22…	REPORT
	https://github.com/puma/puma/commit/ebe9db3929ab8…	REPORT
	https://github.com/puma/puma/pull/3944	REPORT
	https://github.com/puma/puma/pull/3947	REPORT
	https://github.com/puma/puma/releases/tag/v7.2.1	REPORT
	https://github.com/puma/puma/releases/tag/v8.0.2	REPORT
	https://github.com/puma/puma/security/advisories/…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "puma",
            "binary_version": "3.12.4-1ubuntu2+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "puma",
        "purl": "pkg:deb/ubuntu/puma@3.12.4-1ubuntu2+esm2?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.12.0-2ubuntu1",
        "3.12.0-4ubuntu1",
        "3.12.4-1ubuntu2",
        "3.12.4-1ubuntu2+esm1",
        "3.12.4-1ubuntu2+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "puma",
            "binary_version": "5.5.2-2ubuntu2+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "puma",
        "purl": "pkg:deb/ubuntu/puma@5.5.2-2ubuntu2+esm2?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.3.6-1ubuntu4",
        "5.5.2-2ubuntu2",
        "5.5.2-2ubuntu2+esm1",
        "5.5.2-2ubuntu2+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "puma",
            "binary_version": "6.4.2-4ubuntu4.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "puma",
        "purl": "pkg:deb/ubuntu/puma@6.4.2-4ubuntu4.3?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.6.5-4ubuntu2",
        "5.6.5-4ubuntu3",
        "6.4.2-4ubuntu1",
        "6.4.2-4ubuntu3",
        "6.4.2-4ubuntu4",
        "6.4.2-4ubuntu4.3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "puma",
            "binary_version": "6.6.0-4build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "puma",
        "purl": "pkg:deb/ubuntu/puma@6.6.0-4build1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "6.6.0-4",
        "6.6.0-4build1"
      ]
    }
  ],
  "aliases": [],
  "details": "Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2.",
  "id": "UBUNTU-CVE-2026-47737",
  "modified": "2026-07-14T20:17:00Z",
  "published": "2026-07-14T20:17:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-47737"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47737"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/puma/puma/pull/3944"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/puma/puma/pull/3947"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/puma/puma/releases/tag/v7.2.1"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/puma/puma/releases/tag/v8.0.2"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-47737"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-47737 (GCVE-0-2026-47737)

CLEANSTART-2026-CK66622 (CVE-2026-47737)

CLEANSTART-2026-VR87787 (CVE-2026-55831)

FKIE_CVE-2026-47737

GHSA-2VQW-3MP8-CGMX

Impact

Patches

Workarounds

References

UBUNTU-CVE-2026-47737 (CVE-2026-47737)

Tags

Sightings

Nomenclature

Related by attack behaviour