PGV-264211M - Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion Disclosed on June 08, 2026 (updated June 09, 2026)
PGV-264211M is a category 2 vulnerabilty that affects puma, versions ≥ 8.0.0 & < 8.0.2, ≥ 5.5.0 & < 7.2.1
The risk assessment shows that this vulnerability is exlpoited by a external attacker. An unauthorized external actor who attempts to exploit this vulnerability without legitimate access.
The impact is contained to the application. Exploitation remains confined to the application and cannot affect the host environment or external systems.
The threat damage is caused by a denial of service. Exploitation can completely deny access to the application, resulting in a full outage.
PROXY protocol support for Puma was added in version 5.5.0.
When PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer. It waits for "\r\n" to determine whether a PROXY v1 line is present. If an attacker opens a TCP connection and continuously sends bytes without CRLF, Puma keeps appending to this pre-parse buffer.
This can cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer for CRLF. A single, unauthenticated TCP connection can drive significant memory growth and may cause process/container OOM or degraded availability.
Only Puma servers using the following non-default config are affected:
set_remote_address proxy_protocol: :v1
Users should upgrade to versions 7.2.1 or 8.0.2.
# remove/comment this:
# set_remote_address proxy_protocol: :v1
| Network Exposure | External Accessable from the public internet |
| Access Interface | WebBrowser Primarily web-based applications |
| Service Outage | Disruptive Operations would be impacted |
| Data Breach | Disruptive Operations would be impacted |
| Data Tampering | Disruptive Operations would be impacted |
| Customize | |
v2.0.5 © 2026 Inedo, LLC
