CVE-2026-47737 (High) detected in puma-8.0.1.gem

## CVE-2026-47737 - High Severity Vulnerability
Vulnerable Library - puma-8.0.1.gem

Puma is a simple, fast, multi-threaded, and highly parallel HTTP 1.1 server
for Ruby/Rack applications. Puma is intended for use in both development and
production environments. It's great for highly parallel Ruby implementations such as
JRuby and TruffleRuby as well as as providing process worker support to support CRuby well.

Library home page: https://rubygems.org/gems/puma-8.0.1.gem

Sample Path to Dependency File: /Gemfile.lock

Path to vulnerable library: /tmp/containerbase/cache/.ruby/cache/puma-8.0.1.gem

Dependency Hierarchy:
- :x: **puma-8.0.1.gem** (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2.

Publish Date: 2026-07-14

URL: CVE-2026-47737

CVSS 3 Score Details (7.5)

Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-2vqw-3mp8-cgmx

Release Date: 2026-06-09

Fix Resolution: puma - 7.2.1,puma - 8.0.2

***
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)

Start with /Gemfile.lock and locate the puma-8.0.1 entry. Update the dependency to the fixed 8.0.2 release, then verify that the lockfile no longer resolves the vulnerable version and run the repository's available checks.

Written by the indexing model from the issue text.