Update dependency puma to v7 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
puma	5.6.8 → 7.2.1

---

Puma's header normalization allows for client to clobber proxy set headers

CVE-2024-45614 / GHSA-9hf4-67fc-4vf4

More information

Details

Impact

Clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users trusting headers set by their proxy may be affected. Attackers may be able to downgrade connections to HTTP (non-SSL) or redirect responses, which could cause confidentiality leaks if combined with a separate MITM attack.

Patches

v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win.

Workarounds

Nginx has a underscores_in_headers configuration variable to discard these headers at the proxy level.

Any users that are implicitly trusting the proxy defined headers for security or availability should immediately cease doing so until upgraded to the fixed versions.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://github.com/puma/puma/security/advisories/GHSA-9hf4-67fc-4vf4
• https://nvd.nist.gov/vuln/detail/CVE-2024-45614
• https://github.com/puma/puma/commit/cac3fd18cf29ed43719ff5d52d9cfec215f0a043
• https://github.com/puma/puma/commit/f196b23be24712fb8fb16051cc124798cc84f70e
• https://nginx.org/en/docs/http/ngx_http_core_module.html#underscores_in_headers
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2024-45614.yml
• https://lists.debian.org/debian-lts-announce/2024/11/msg00004.html
• https://github.com/advisories/GHSA-9hf4-67fc-4vf4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

CVE-2026-47736 / GHSA-qpgp-93vx-g8v8

More information

Details

Impact

PROXY protocol support for Puma was added in version 5.5.0.

When PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer. It waits for "\r\n" to determine whether a PROXY v1 line is present. If an attacker opens a TCP connection and continuously sends bytes without CRLF, Puma keeps appending to this pre-parse buffer.

This can cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer for CRLF. A single, unauthenticated TCP connection can drive significant memory growth and may cause process/container OOM or degraded availability.

Only Puma servers using the following non-default config are affected:

   set_remote_address proxy_protocol: :v1

Patches

Users should upgrade to versions 7.2.1 or 8.0.2.

Workarounds

• Disable PROXY protocol v1 parsing if it is not required:

  # remove/comment this:
  # set_remote_address proxy_protocol: :v1

• Restrict direct network access to Puma listeners using PROXY protocol:
  • Only allow trusted load balancers/reverse proxies to connect.
  • Block arbitrary client TCP access with firewall/security group rules.

Resources

• HAProxy PROXY protocol specification
• CWE-400: Uncontrolled Resource Consumption
• CWE-770: Allocation of Resources Without Limits or Throttling
• Puma set_remote_address documentation
• Puma client PROXY protocol parsing code
• Puma constants, including PROXY_PROTOCOL_V1_REGEX

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/puma/puma/security/advisories/GHSA-qpgp-93vx-g8v8
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2026-47736.yml
• https://www.cve.org/CVERecord?id=CVE-2026-47736
• https://github.com/advisories/GHSA-qpgp-93vx-g8v8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

CVE-2026-47737 / GHSA-2vqw-3mp8-cgmx

More information

Details

Impact

Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used.

PROXY protocol v1 is a connection-level protocol. Support was added to Puma in v5.5.0. A proxy sends one PROXY header at the beginning of a TCP connection, before any HTTP data. Puma incorrectly re-parsed PROXY protocol headers after each keep-alive request on the same connection. An attacker able to send HTTP requests through a trusted proxy could therefore inject a second PROXY header between HTTP requests. Puma would treat the injected header as authoritative for the next request and overwrite REMOTE_ADDR.

This can mislead applications or middleware that use REMOTE_ADDR for security decisions, rate limiting, auditing, or allow/deny lists.

Only deployments that explicitly enable PROXY protocol v1 are affected, and will have set:

set_remote_address proxy_protocol: :v1

Puma's default configuration is not affected. Deployments that do not use persistent connections to Puma are also not expected to be affected by this issue.

Patches

Users should upgrade to versions 7.2.1 or 8.0.2.

Workarounds

Disable PROXY protocol v1 parsing if it is not required:

  # remove/comment this:
  # set_remote_address proxy_protocol: :v1

Users can also disable persistent connections to Puma, for example:

enable_keep_alives false

References

• HAProxy PROXY protocol specification
• CVE-2025-31135 / GHSA-c2c3-pqw5-5p7c: go-guerrilla repeated PROXY command source IP spoofing
• Puma set_remote_address documentation

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2026-47737.yml
• https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-47737
• https://github.com/advisories/GHSA-2vqw-3mp8-cgmx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Gemfile.lock

[17:00:11.346] INFO (772): Installing tool [email protected]...
Download failed: https://github.com/containerbase/ruby-prebuild/releases/download/3.0.3/ruby-3.0.3-jammy-x86_64.tar.xz
Download failed, retrying
Download failed: https://github.com/containerbase/ruby-prebuild/releases/download/3.0.3/ruby-3.0.3-jammy-x86_64.tar.xz
Download failed, retrying
Download failed: https://github.com/containerbase/ruby-prebuild/releases/download/3.0.3/ruby-3.0.3-jammy-x86_64.tar.xz
Download failed: https://github.com/containerbase/ruby-prebuild/releases/download/3.0.3/ruby-3.0.3-jammy-x86_64.tar.xz
[17:00:13.888] INFO (844): Downloading file ...
    url: "https://github.com/containerbase/ruby-prebuild/releases/download/3.0.3/ruby-3.0.3-jammy-x86_64.tar.xz"
    output: "/runner/cache/containerbase/500bb85aafd22fa0602ae4677b8244140f70593fdf1f82434c353a72ed783ac4/ruby-3.0.3-jammy-x86_64.tar.xz"
[17:00:14.016] ERROR (844): Request failed with status code 404 (Not Found): GET https://github.com/containerbase/ruby-prebuild/releases/download/3.0.3/ruby-3.0.3-jammy-x86_64.tar.xz
[17:00:14.017] FATAL (844): Download failed in 129ms.
[17:00:14.078] ERROR (772): Command failed with exit code 1: bash /usr/local/containerbase/bin/v2-install-tool.sh install ruby 3.0.3
[17:00:14.079] FATAL (772): Install tool ruby failed in 2.7s.