---
id: CVE-2026-47737
aliases:
  - GHSA-2vqw-3mp8-cgmx
title: >-
  Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent
  Connections
summary: >-
  Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent
  Connections
severity: high
cvss: 7.5
cwe:
  - CWE-290
  - CWE-345
vendor: puma
product: puma
ecosystem: rubygems
affected:
  - 'puma >= 8.0.0, < 8.0.2'
  - 'puma >= 5.5.0, < 7.2.1'
patched:
  - puma 8.0.2
  - puma 7.2.1
published: '2026-06-09'
updated: '2026-06-09'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-2vqw-3mp8-cgmx'
references:
  - url: 'https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx'
  - url: >-
      https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2026-47737.yml
  - url: 'https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-47737'
  - url: 'https://github.com/advisories/GHSA-2vqw-3mp8-cgmx'
tags:
  - ghsa
  - rubygems
ingestedAt: '2026-07-07T15:41:59.608Z'
epss: 0.00266
epssPercentile: 0.18764
---

## Overview

### Impact

Puma is vulnerable to source IP spoofing when `set_remote_address proxy_protocol: :v1` is enabled and persistent connections are used.

PROXY protocol v1 is a connection-level protocol. [Support was added to Puma in v5.5.0](https://github.com/puma/puma/issues/2651). A proxy sends one PROXY header at the beginning of a TCP connection, before any HTTP data. Puma incorrectly re-parsed PROXY protocol headers after each keep-alive request on the same connection. An attacker able to send HTTP requests through a trusted proxy could therefore inject a second PROXY header between HTTP requests. Puma would treat the injected header as authoritative for the next request and overwrite `REMOTE_ADDR`.

This can mislead applications or middleware that use `REMOTE_ADDR` for security decisions, rate limiting, auditing, or allow/deny lists.

**Only deployments that explicitly enable PROXY protocol v1 are affected**, and will have set:

```ruby
set_remote_address proxy_protocol: :v1
```

Puma's default configuration is not affected. Deployments that do not use persistent connections to Puma are also not expected to be affected by this issue.

### Patches

Users should upgrade to versions 7.2.1 or 8.0.2.

### Workarounds

Disable PROXY protocol v1 parsing if it is not required:

 ```ruby
   # remove/comment this:
   # set_remote_address proxy_protocol: :v1
 ```

Users can also disable persistent connections to Puma, for example:

```ruby
enable_keep_alives false
```

### References

- [HAProxy PROXY protocol specification](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)
- [CVE-2025-31135 / GHSA-c2c3-pqw5-5p7c: go-guerrilla repeated PROXY command source IP spoofing](https://github.com/phires/go-guerrilla/security/advisories/GHSA-c2c3-pqw5-5p7c)
- [Puma `set_remote_address` documentation](https://github.com/puma/puma/blob/master/lib/puma/dsl.rb)

## Affected packages

- `puma >= 8.0.0, < 8.0.2`
- `puma >= 5.5.0, < 7.2.1`

## Remediation

Upgrade to a patched release:

- `puma 8.0.2`
- `puma 7.2.1`