CVE-2026-47736

A flaw was found in Puma, a Ruby/Rack web server. When PROXY protocol v1 support is enabled, a remote attacker can continuously send data without proper termination. This causes the server to consume an increasing amount of memory and CPU resources, leading to a Denial of Service (DoS) where the server becomes unresponsive or crashes.

This issue only affects Puma deployments that explicitly enable the non-default proxy_protocol: :v1 remote-address configuration (set_remote_address proxy_protocol: :v1). An unauthenticated network attacker able to open a TCP connection to such a listener can send bytes without a terminating CRLF, causing unbounded growth of an internal pre-parse buffer and a potential denial of service. Deployments that do not enable this configuration are not affected by this specific issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.