CVE-2026-47737: puma Authentication Bypass by Spoofing
CVSS: 7.5v3.1HighDeferred
AliasesUBUNTU-CVE-2026-47737DEBIAN-CVE-2026-47737CGA-7gg7-x5mm-pj36CGA-g692-j8rq-35vrCGA-jc6m-8r9r-253rCGA-mwg4-x5c9-f5hwCGA-qj82-g4fp-84j7CGA-qm5w-5j73-2phhCGA-qp8p-9m5r-rwhpCGA-xp6h-g668-hcgmCGA-2hhc-62q2-fw2rCGA-32hp-5f7v-g2vhCGA-3gv2-xww4-w84xCGA-3gw6-293w-c42vCGA-3m7q-cjg2-hhmrCGA-3r3f-g8v9-hh92CGA-49mm-hqxf-wg87CGA-4fjh-qcxp-mqm2CGA-4fvm-3r4c-57q6CGA-4hwj-rfvj-75cxCGA-4m47-5xj4-qxp3CGA-4xhg-wr7r-36pqCGA-4xvf-3qfq-wm58CGA-4xxh-w8mq-947rCGA-5384-q5xx-6gfvCGA-54qr-cp95-58rjCGA-59jf-v4pv-m5jfCGA-63pm-qpqq-qg7fCGA-644r-j47h-vc66CGA-69rm-pwqv-8jjpCGA-6jg4-vr6m-5m55CGA-6q62-74cr-j5vjCGA-6vqx-cw8f-78mxCGA-726h-2c4f-73qvCGA-757h-h7h2-v6q8CGA-7mmw-q24x-38q5CGA-83c4-fvjg-4r7hCGA-8fm3-xc35-fwqwCGA-95x7-2g66-qhwjCGA-9f33-492m-g8ffCGA-9f49-3698-928wCGA-9fcq-gv83-93gmCGA-9h2f-cr46-xj56CGA-c5hx-252m-j8hrCGA-f2mj-vpjv-fj9cCGA-f42r-wfpx-64cgCGA-g4mh-m8jq-pqw5CGA-ghgf-wpqj-5j83CGA-gm2j-fjgx-fv87CGA-grf6-q4ww-2w7gCGA-gv9g-7hcv-vp43CGA-h956-2m6m-87vpCGA-hc79-x5pr-5j7rCGA-hc95-wmvf-94hcCGA-hh22-937v-qhrjCGA-jc3q-43m3-3r5pCGA-jqwp-2hj9-gx89CGA-m874-qc2m-pmwwCGA-pc5g-2pcj-4vwqCGA-pgpr-c9x5-528cCGA-ph28-8rg9-gqg9CGA-pmg4-j7w7-6pchCGA-pr4h-vrw9-q3cvGHSA-2vqw-3mp8-cgmxCGA-pxwm-vq76-76j9CGA-q276-wj8x-4gw2CGA-qg2g-pwgm-cpppCGA-qrf9-r4m7-qm67CGA-rp6v-xwp3-mq58CGA-rqj5-92gw-rx68CGA-rrc5-w357-5445CGA-v56q-fq5w-w8r7CGA-vgww-6vvq-wv3xCGA-vp3q-x6wj-vvr3CGA-vwxh-9f2h-8fr4CGA-wh59-fw2c-qv7gCGA-wqw2-phqh-qrc9CGA-wxfm-229x-jwp8CGA-x8hv-gqqq-cjr5CGA-x95x-98c2-3874CGA-x9mx-r4x4-h78vCGA-xh7h-m4qv-gw63CGA-xj65-c26c-4936
Published 14-07-2026Last modified 15-07-2026
Vulnerability summary
CVE-2026-47737 is a high (CVSS 7.5) Authentication Bypass by Spoofing vulnerability in puma. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 6.8% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.18%
0%100%
Low · -0.09 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 14-07-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · RubygemsEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.18%
Chance of exploitation in the next 30 days
Percentile
7%
Versus all other CVEs
30-day change
-0.09 pp
From 0.27% on 20-09-2026
20-09-202620-10-2026
EPSS score0.18%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-290Authentication Bypass by SpoofingThis attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
- CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Affected systems
Chainguard40 products
- gitlab-exporter-18.10< 18.10.8-r1
- gitlab-exporter-18.11< 18.11.6-r2
- gitlab-exporter-19.0< 19.0.0-r2
- gitlab-exporter-19.1< 19.1.1-r1
- gitlab-rails-ce-18.1All versions (No fix recorded)
Wolfi4 products
- logstash-9.3< 9.3.7-r0
- logstash-9.3-iamguarded-compat< 9.3.7-r0
- logstash-9.4< 9.4.4-r0
- logstash-9.4-iamguarded-compat< 9.4.4-r0
Debian1 product
- puma< 5.6.5-3+deb12u2 | All versions (No fix recorded) | < 8.0.2-1
Puma1 product
- puma≥ 5.5.0, < 7.2.1 | ≥ 8.0.0, < 8.0.2
RubyGems1 product
- puma≥ 8.0.0, < 8.0.2 | ≥ 5.5.0, < 7.2.1
Ubuntu1 product
- pumaAll versions (No fix recorded)
6 vendors · 48 products
References
15 links
Show all 15 references
- github.com/puma/pumaPACKAGE