Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

Not analysed yet

We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.

Severity and exploitation

• CISA KEV Not listed.
• EPSS 0.0018, the 7th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

1. 9 Jun 2026, 00:09 UTC Confirmed by GitHub Advisory Database
2. 31 Oct 2026, 15:16 UTC First seen by agentprime
3. 31 Oct 2026, 15:16 UTC Confirmed by OSV

Sources

• GitHub Advisory Database: GHSA-2vqw-3mp8-cgmx
• OSV: GHSA-2vqw-3mp8-cgmx
• github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx
• github.com/puma/puma/pull/3944
• github.com/puma/puma/pull/3947
• github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f
• github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58
• github.com/puma/puma
• github.com/puma/puma/releases/tag/v7.2.1
• github.com/puma/puma/releases/tag/v8.0.2
• github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2026-47737.yml
• nvd.nist.gov/vuln/detail/cve-2026-47737
• www.cve.org/CVERecord/SearchResults?query=CVE-2026-47737

Facts on this page come from the GitHub Advisory Database (CC-BY 4.0), OSV and the other sources listed, as published. We don’t reproduce full advisory descriptions, which can contain exploit code.