CVE-2026-47736

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47736", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-19T22:16:39.503Z", "datePublished": "2026-07-14T19:54:26.229Z", "dateUpdated": "2026-07-15T14:28:29.155Z"}, "containers": {"cna": {"title": "Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8"}, {"name": "https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f", "tags": ["x_refsource_MISC"], "url": "https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f"}, {"name": "https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58", "tags": ["x_refsource_MISC"], "url": "https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58"}, {"name": "https://github.com/puma/puma/releases/tag/v7.2.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/puma/puma/releases/tag/v7.2.1"}, {"name": "https://github.com/puma/puma/releases/tag/v8.0.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/puma/puma/releases/tag/v8.0.2"}], "affected": [{"vendor": "puma", "product": "puma", "versions": [{"version": ">= 5.5.0, < 7.2.1", "status": "affected"}, {"version": ">= 8.0.0, < 8.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-14T19:54:26.229Z"}, "descriptions": [{"lang": "en", "value": "Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends bytes without CRLF to cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer. This issue is fixed in versions 7.2.1 and 8.0.2."}], "source": {"advisory": "GHSA-qpgp-93vx-g8v8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-15T14:27:41.068975Z", "id": "CVE-2026-47736", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T14:28:29.155Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47736", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-19T22:16:39.503Z", "datePublished": "2026-07-14T19:54:26.229Z", "dateUpdated": "2026-07-15T14:28:29.155Z"}, "containers": {"cna": {"title": "Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8"}, {"name": "https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f", "tags": ["x_refsource_MISC"], "url": "https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f"}, {"name": "https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58", "tags": ["x_refsource_MISC"], "url": "https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58"}, {"name": "https://github.com/puma/puma/releases/tag/v7.2.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/puma/puma/releases/tag/v7.2.1"}, {"name": "https://github.com/puma/puma/releases/tag/v8.0.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/puma/puma/releases/tag/v8.0.2"}], "affected": [{"vendor": "puma", "product": "puma", "versions": [{"version": ">= 5.5.0, < 7.2.1", "status": "affected"}, {"version": ">= 8.0.0, < 8.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-14T19:54:26.229Z"}, "descriptions": [{"lang": "en", "value": "Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends bytes without CRLF to cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer. This issue is fixed in versions 7.2.1 and 8.0.2."}], "source": {"advisory": "GHSA-qpgp-93vx-g8v8", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47736", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T14:27:41.068975Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T14:28:01.144Z"}}]}}

{"affected": [{"affectedData": [{"product": "puma", "vendor": "puma", "versions": [{"status": "affected", "version": ">= 5.5.0, < 7.2.1"}, {"status": "affected", "version": ">= 8.0.0, < 8.0.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends bytes without CRLF to cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer. This issue is fixed in versions 7.2.1 and 8.0.2."}], "id": "CVE-2026-47736", "lastModified": "2026-07-15T18:15:13.373", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47736", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-15T14:27:41.068975Z", "version": "2.0.3"}}]}, "published": "2026-07-14T20:17:03.620", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f"}, {"source": "security-advisories@github.com", "url": "https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58"}, {"source": "security-advisories@github.com", "url": "https://github.com/puma/puma/releases/tag/v7.2.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/puma/puma/releases/tag/v8.0.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "puma: Puma: Denial of Service due to unbounded memory growth in PROXY protocol v1", "id": "2500583", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500583"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in Puma, a Ruby/Rack web server. When PROXY protocol v1 support is enabled, a remote attacker can continuously send data without proper termination. This causes the server to consume an increasing amount of memory and CPU resources, leading to a Denial of Service (DoS) where the server becomes unresponsive or crashes."], "mitigation": {"lang": "en:us", "value": "Upgrade to Puma 7.2.1 (7.x branch) or 8.0.2 (8.x branch), whichever applies to the deployed release line. If an immediate upgrade is not possible, remove or comment out the set_remote_address proxy_protocol: :v1 configuration directive if it is not required, or restrict direct network access to the affected Puma listener to trusted load balancers or reverse proxies only."}, "name": "CVE-2026-47736", "package_state": [{"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Not affected", "package_name": "3scale-amp21/backend", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Not affected", "package_name": "3scale-amp21/zync", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Not affected", "package_name": "3scale-amp22/backend", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Not affected", "package_name": "3scale-amp22/zync", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Not affected", "package_name": "3scale-amp2/backend-rhel8", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Not affected", "package_name": "3scale-amp2/zync-rhel8", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Not affected", "package_name": "3scale-amp2/zync-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "pcs", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "pcs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "pcs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "rubygem-puma", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "satellite:el8/rubygem-puma", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-07-14T19:54:26Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-47736\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-47736\nhttps://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f\nhttps://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58\nhttps://github.com/puma/puma/releases/tag/v7.2.1\nhttps://github.com/puma/puma/releases/tag/v8.0.2\nhttps://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8"], "statement": "This issue only affects Puma deployments that explicitly enable the non-default proxy_protocol: :v1 remote-address configuration (set_remote_address proxy_protocol: :v1). An unauthenticated network attacker able to open a TCP connection to such a listener can send bytes without a terminating CRLF, causing unbounded growth of an internal pre-parse buffer and a potential denial of service. Deployments that do not enable this configuration are not affected by this specific issue.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.5.0,7.2.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.0.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "puma", "source": "cna", "vendor": "puma"}, "product": "puma", "vendor": "puma"}], "created": "2026-07-15T16:15:04.174992+00:00", "updated": "2026-08-01T09:30:03.821004+00:00", "vendors": ["puma", "puma$PRODUCT$puma"]}