Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

Impact

Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used.

PROXY protocol v1 is a connection-level protocol. Support was added to Puma in v5.5.0. A proxy sends one PROXY header at the beginning of a TCP connection, before any HTTP data. Puma incorrectly re-parsed PROXY protocol headers after each keep-alive request on the same connection. An attacker able to send HTTP requests through a trusted proxy could therefore inject a second PROXY header between HTTP requests. Puma would treat the injected header as authoritative for the next request and overwrite REMOTE_ADDR.

This can mislead applications or middleware that use REMOTE_ADDR for security decisions, rate limiting, auditing, or allow/deny lists.

Only deployments that explicitly enable PROXY protocol v1 are affected, and will have set:

set_remote_address proxy_protocol: :v1

Puma's default configuration is not affected. Deployments that do not use persistent connections to Puma are also not expected to be affected by this issue.

Patches

Users should upgrade to versions 7.2.1 or 8.0.2.

Workarounds

Disable PROXY protocol v1 parsing if it is not required:

   # remove/comment this:
   # set_remote_address proxy_protocol: :v1

Users can also disable persistent connections to Puma, for example:

enable_keep_alives false

References

• HAProxy PROXY protocol specification
• CVE-2025-31135 / GHSA-c2c3-pqw5-5p7c: go-guerrilla repeated PROXY command source IP spoofing
• Puma set_remote_address documentation

Puma's header normalization allows for client to clobber proxy set headers

Impact

Clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users trusting headers set by their proxy may be affected. Attackers may be able to downgrade connections to HTTP (non-SSL) or redirect responses, which could cause confidentiality leaks if combined with a separate MITM attack.

Patches

v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win.

Workarounds

Nginx has a underscoresinheaders configuration variable to discard these headers at the proxy level.

Any users that are implicitly trusting the proxy defined headers for security or availability should immediately cease doing so until upgraded to the fixed versions.

Puma HTTP Request/Response Smuggling vulnerability

Impact

Prior to versions 6.4.2 and 5.6.8, puma exhibited dangerous behavior when parsing chunked transfer encoding bodies.

Fixed versions limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption.

Patches

The vulnerability has been fixed in 6.4.2 and 5.6.8.

Workarounds

No known workarounds.

References

• HTTP Request Smuggling
• Open an issue in Puma
• See our security policy

Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

Impact

PROXY protocol support for Puma was added in version 5.5.0.

When PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer. It waits for \r\n to determine whether a PROXY v1 line is present. If an attacker opens a TCP connection and continuously sends bytes without CRLF, Puma keeps appending to this pre-parse buffer.

This can cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer for CRLF. A single, unauthenticated TCP connection can drive significant memory growth and may cause process/container OOM or degraded availability.

Only Puma servers using the following non-default config are affected:

   set_remote_address proxy_protocol: :v1

Patches

Users should upgrade to versions 7.2.1 or 8.0.2.

Workarounds

• Disable PROXY protocol v1 parsing if it is not required:

   # remove/comment this:
   # set_remote_address proxy_protocol: :v1

• Restrict direct network access to Puma listeners using PROXY protocol:
  • Only allow trusted load balancers/reverse proxies to connect.
  • Block arbitrary client TCP access with firewall/security group rules.

Resources

• HAProxy PROXY protocol specification
• CWE-400: Uncontrolled Resource Consumption
• CWE-770: Allocation of Resources Without Limits or Throttling
• Puma set_remote_address documentation
• Puma client PROXY protocol parsing code
• Puma constants, including PROXY_PROTOCOL_V1_REGEX

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in puma

Impact

Prior to version 6.3.1, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling.

The following vulnerabilities are addressed by this advisory: - Incorrect parsing of trailing fields in chunked transfer encoding bodies - Parsing of blank/zero-length Content-Length headers\r\n

Patches

The vulnerability has been fixed in 6.3.1 and 5.6.7.

Workarounds

No known workarounds.

References

HTTP Request Smuggling

Puma HTTP Request/Response Smuggling vulnerability

Impact

Prior to versions 6.4.2 and 5.6.8, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling.

Fixed versions limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption.

Patches

The vulnerability has been fixed in 6.4.2 and 5.6.8.

Workarounds

No known workarounds.

References

• HTTP Request Smuggling
• Open an issue in Puma
• See our security policy

Puma's header normalization allows for client to clobber proxy set headers

Impact

Clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For).

Any users trusting headers set by their proxy may be affected. Attackers may be able to downgrade connections to HTTP (non-SSL) or redirect responses, which could cause confidentiality leaks if combined with a separate MITM attack.

Patches

v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win.

Workarounds

Nginx has a underscoresinheaders configuration variable to discard these headers at the proxy level.

Any users that are implicitly trusting the proxy defined headers for security or availability should immediately cease doing so until upgraded to the fixed versions.

Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

Impact

PROXY protocol support for Puma was added in version 5.5.0.

When PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer. It waits for \r\n to determine whether a PROXY v1 line is present. If an attacker opens a TCP connection and continuously sends bytes without CRLF, Puma keeps appending to this pre-parse buffer.

This can cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer for CRLF. A single, unauthenticated TCP connection can drive significant memory growth and may cause process/container OOM or degraded availability.

Only Puma servers using the following non-default config are affected:

setremoteaddress proxy_protocol: :v1

Workarounds

• Disable PROXY protocol v1 parsing if it is not required:

  remove/comment this:

  setremoteaddress proxy_protocol: :v1

• Restrict direct network access to Puma listeners using PROXY protocol:

  • Only allow trusted load balancers/reverse proxies to connect.
  • Block arbitrary client TCP access with firewall/security group rules.

Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

Impact

Puma is vulnerable to source IP spoofing when setremoteaddress proxy_protocol: :v1 is enabled and persistent connections are used.

PROXY protocol v1 is a connection-level protocol. Support was added to Puma in v5.5.0. A proxy sends one PROXY header at the beginning of a TCP connection, before any HTTP data. Puma incorrectly re-parsed PROXY protocol headers after each keep-alive request on the same connection. An attacker able to send HTTP requests through a trusted proxy could therefore inject a second PROXY header between HTTP requests. Puma would treat the injected header as authoritative for the next request and overwrite REMOTE_ADDR.

This can mislead applications or middleware that use REMOTE_ADDR for security decisions, rate limiting, auditing, or allow/deny lists.

Only deployments that explicitly enable PROXY protocol v1 are affected, and will have set:

setremoteaddress proxy_protocol: :v1

Puma's default configuration is not affected. Deployments that do not use persistent connections to Puma are also not expected to be affected by this issue.

Workarounds

• Disable PROXY protocol v1 parsing if it is not required:

# remove/comment this: # setremoteaddress proxy_protocol: :v1

Users can also disable persistent connections to Puma, for example:

enablekeepalives false

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in puma

Impact

Prior to version 6.3.1, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling.

The following vulnerabilities are addressed by this advisory: - Incorrect parsing of trailing fields in chunked transfer encoding bodies - Parsing of blank/zero-length Content-Length headers\r\n

Patches

The vulnerability has been fixed in 6.3.1 and 5.6.7.

Workarounds

No known workarounds.

References

HTTP Request Smuggling