CVE-2026-47736 Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion
Attackers can cause memory exhaustion and high CPU usage in Puma web servers by sending malformed PROXY protocol data when that feature is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47736?
CVE-2026-47736 is a high-severity denial of service vulnerability in puma, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends bytes without CRLF to cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer. This issue is fixed in versions 7.2.1 and 8.0.2.
Weakness: CWE-400
Which versions are affected by CVE-2026-47736?
4 open source packages ship an affected version, including puma.
| Package | Affected | Fixed in |
|---|---|---|
puma RubyGems | From 5.5.0 | 7.2.1 |
puma RubyGems | From 5.5.0 | 7.2.1 |
puma RubyGems | From 8.0.0 | 8.0.2 |
puma RubyGems | From 8.0.0 | 8.0.2 |
How do I fix CVE-2026-47736?
Upgrade puma to a fixed version for your release line: 7.2.1 or 8.0.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-47736 being exploited?
There is no known exploitation of CVE-2026-47736 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-CY39942, CLEANSTART-2026-JZ57478, DEBIAN-CVE-2026-47736, GHSA-qpgp-93vx-g8v8, MINI-23mr-h637-5ww5, MINI-4365-p7p8-mwcg and 25 more.