Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

Not analysed yet

We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.

Severity and exploitation

• CISA KEV Not listed.
• EPSS 0.0035, the 28th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

1. 8 Jun 2026, 23:55 UTC Confirmed by GitHub Advisory Database
2. 31 Oct 2026, 15:16 UTC First seen by agentprime
3. 31 Oct 2026, 15:16 UTC Confirmed by OSV

Sources

• GitHub Advisory Database: GHSA-qpgp-93vx-g8v8
• OSV: GHSA-qpgp-93vx-g8v8
• github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8
• github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f
• github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58
• github.com/puma/puma
• github.com/puma/puma/releases/tag/v7.2.1
• github.com/puma/puma/releases/tag/v8.0.2
• github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2026-47736.yml
• nvd.nist.gov/vuln/detail/cve-2026-47736
• www.cve.org/CVERecord?id=CVE-2026-47736

Facts on this page come from the GitHub Advisory Database (CC-BY 4.0), OSV and the other sources listed, as published. We don’t reproduce full advisory descriptions, which can contain exploit code.