CVE-2026-47737

A flaw was found in Puma, a Ruby/Rack web server. When set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used, Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection. This allows a remote attacker to inject a second PROXY header, leading to source IP (Internet Protocol) spoofing and potentially impacting security logging or access control decisions.

This flaw only affects Puma deployments that explicitly enable set_remote_address proxy_protocol: :v1 together with persistent (keep-alive) connections to the proxy. This is not Puma default configuration.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.