Update dependency puma to v7 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
puma	"~> 5.0" → "~> 7.0"

---

Puma HTTP Request/Response Smuggling vulnerability

CVE-2023-40175 / GHSA-68xg-gqqm-vgj8

More information

Details

Impact

Prior to version 6.3.1, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling.

The following vulnerabilities are addressed by this advisory:

• Incorrect parsing of trailing fields in chunked transfer encoding bodies
• Parsing of blank/zero-length Content-Length headers

Patches

The vulnerability has been fixed in 6.3.1 and 5.6.7.

Workarounds

No known workarounds.

References

HTTP Request Smuggling

For more information

If you have any questions or comments about this advisory:

Open an issue in Puma
See our security policy

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8
• https://github.com/puma/puma/commit/690155e7d644b80eeef0a6094f9826ee41f1080a
• https://github.com/puma/puma/commit/ed0f2f94b56982c687452504b95d5f1fbbe3eed1
• https://github.com/puma/puma/releases/tag/v5.6.7
• https://github.com/puma/puma/releases/tag/v6.3.1
• https://nvd.nist.gov/vuln/detail/CVE-2023-40175
• https://github.com/puma/puma/commit/7405a219801dcebc0ad6e0aa108d4319ca23f662
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2023-40175.yml
• https://github.com/advisories/GHSA-68xg-gqqm-vgj8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Puma HTTP Request/Response Smuggling vulnerability

CVE-2024-21647 / GHSA-c2f4-cvqm-65w2

More information

Details

Impact

Prior to versions 6.4.2 and 5.6.8, puma exhibited dangerous behavior when parsing chunked transfer encoding bodies.

Fixed versions limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption.

Patches

The vulnerability has been fixed in 6.4.2 and 5.6.8.

Workarounds

No known workarounds.

References

• HTTP Request Smuggling
• Open an issue in Puma
• See our security policy

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/puma/puma/security/advisories/GHSA-c2f4-cvqm-65w2
• https://nvd.nist.gov/vuln/detail/CVE-2024-21647
• https://github.com/puma/puma/commit/5fc43d73b6ff193325e657a24ed76dec79133e93
• https://github.com/puma/puma/commit/60d5ee3734adc8cee85c3f0561af392448fe19b7
• https://github.com/puma/puma/commit/bbb880ffb6debbfdea535b4b3eb2204d49ae151d
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2024-21647.yml
• https://lists.debian.org/debian-lts-announce/2024/11/msg00004.html
• https://github.com/advisories/GHSA-c2f4-cvqm-65w2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Puma's header normalization allows for client to clobber proxy set headers

CVE-2024-45614 / GHSA-9hf4-67fc-4vf4

More information

Details

Impact

Clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users trusting headers set by their proxy may be affected. Attackers may be able to downgrade connections to HTTP (non-SSL) or redirect responses, which could cause confidentiality leaks if combined with a separate MITM attack.

Patches

v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win.

Workarounds

Nginx has a underscores_in_headers configuration variable to discard these headers at the proxy level.

Any users that are implicitly trusting the proxy defined headers for security or availability should immediately cease doing so until upgraded to the fixed versions.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://github.com/puma/puma/security/advisories/GHSA-9hf4-67fc-4vf4
• https://nvd.nist.gov/vuln/detail/CVE-2024-45614
• https://github.com/puma/puma/commit/cac3fd18cf29ed43719ff5d52d9cfec215f0a043
• https://github.com/puma/puma/commit/f196b23be24712fb8fb16051cc124798cc84f70e
• https://nginx.org/en/docs/http/ngx_http_core_module.html#underscores_in_headers
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2024-45614.yml
• https://lists.debian.org/debian-lts-announce/2024/11/msg00004.html
• https://github.com/advisories/GHSA-9hf4-67fc-4vf4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

CVE-2026-47736 / GHSA-qpgp-93vx-g8v8

More information

Details

Impact

PROXY protocol support for Puma was added in version 5.5.0.

When PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer. It waits for "\r\n" to determine whether a PROXY v1 line is present. If an attacker opens a TCP connection and continuously sends bytes without CRLF, Puma keeps appending to this pre-parse buffer.

This can cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer for CRLF. A single, unauthenticated TCP connection can drive significant memory growth and may cause process/container OOM or degraded availability.

Only Puma servers using the following non-default config are affected:

   set_remote_address proxy_protocol: :v1

Patches

Users should upgrade to versions 7.2.1 or 8.0.2.

Workarounds

• Disable PROXY protocol v1 parsing if it is not required:

  # remove/comment this:
  # set_remote_address proxy_protocol: :v1

• Restrict direct network access to Puma listeners using PROXY protocol:
  • Only allow trusted load balancers/reverse proxies to connect.
  • Block arbitrary client TCP access with firewall/security group rules.

Resources

• HAProxy PROXY protocol specification
• CWE-400: Uncontrolled Resource Consumption
• CWE-770: Allocation of Resources Without Limits or Throttling
• Puma set_remote_address documentation
• Puma client PROXY protocol parsing code
• Puma constants, including PROXY_PROTOCOL_V1_REGEX

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2026-47736.yml
• https://www.cve.org/CVERecord?id=CVE-2026-47736
• https://github.com/advisories/GHSA-qpgp-93vx-g8v8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

CVE-2026-47737 / GHSA-2vqw-3mp8-cgmx

More information

Details

Impact

Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used.

PROXY protocol v1 is a connection-level protocol. Support was added to Puma in v5.5.0. A proxy sends one PROXY header at the beginning of a TCP connection, before any HTTP data. Puma incorrectly re-parsed PROXY protocol headers after each keep-alive request on the same connection. An attacker able to send HTTP requests through a trusted proxy could therefore inject a second PROXY header between HTTP requests. Puma would treat the injected header as authoritative for the next request and overwrite REMOTE_ADDR.

This can mislead applications or middleware that use REMOTE_ADDR for security decisions, rate limiting, auditing, or allow/deny lists.

Only deployments that explicitly enable PROXY protocol v1 are affected, and will have set:

set_remote_address proxy_protocol: :v1

Puma's default configuration is not affected. Deployments that do not use persistent connections to Puma are also not expected to be affected by this issue.

Patches

Users should upgrade to versions 7.2.1 or 8.0.2.

Workarounds

Disable PROXY protocol v1 parsing if it is not required:

  # remove/comment this:
  # set_remote_address proxy_protocol: :v1

Users can also disable persistent connections to Puma, for example:

enable_keep_alives false

References

• HAProxy PROXY protocol specification
• CVE-2025-31135 / GHSA-c2c3-pqw5-5p7c: go-guerrilla repeated PROXY command source IP spoofing
• Puma set_remote_address documentation

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2026-47737.yml
• https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-47737
• https://github.com/advisories/GHSA-2vqw-3mp8-cgmx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request