High [CVE-2026-47737] Source IP spoofing via PROXY protocol header re-parsing
This high-severity Red Hat Linux advisory covers CVE-2026-47737.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Puma is a Ruby/Rack web server built for parallelism.
From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol::v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR.
This issue is fixed in versions 7.2.1 and 8.0.2. This allows a remote attacker to inject a second PROXY header, leading to source IP (Internet Protocol) spoofing and potentially impacting security logging or access control decisions.
This is not Puma default configuration. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Weakness: CWE-358. Red Hat lists Red Hat 3scale API Management Platform 2; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Satellite 6 as not affected.
- 5.5.0
Official advisory · high-confidence parse· fetched 6 days ago·verify at source
- 7.2.1
- 8.0.2
Official advisory · high-confidence parse· fetched 6 days ago·verify at source
Mitigation checklist
- Upgrade puma to 7.2.1 or 8.0.2 (or later). If an immediate upgrade is not possible, remove the `set_remote_address proxy_protocol: :v1` configuration, or disable persistent connections (`enable_keep_alives false`), to prevent PROXY protocol v1 header re-parsing on the same connection.
Official advisory · high-confidence parse· fetched 6 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.