Puma EUVD-2026-44427

Three concrete conditions must all hold: (1) Puma is configured with set_remote_address proxy_protocol: :v1 in its DSL - the default configuration without this directive is not vulnerable; (2) persistent/keep-alive TCP connections are used between the upstream proxy and Puma, so multiple HTTP requests share one connection (mitigated by enable_keep_alives false); and (3) the attacker can route requests through that trusted proxy to Puma. Exploit impact is further gated by whether the downstream Ruby/Rack application actually uses REMOTE_ADDR for a security-sensitive decision (allow-lists, rate limiting, audit). Network-reachable and unauthenticated (PR:N), but limited to the affected version ranges 5.5.0-7.2.0 and 8.0.0-8.0.1 of the Puma rubygem.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N produces a 7.5 score reflecting network-reachable, unauthenticated exploitation with high integrity impact and no confidentiality or availability loss - consistent with a spoofing primitive rather than RCE. EPSS and KEV data are not provided in the input, so widespread exploitation cannot be asserted, and no public exploit identified at time of analysis. Real-world risk is meaningfully lower than the raw CVSS suggests because exploitation requires three concurrent conditions that are NOT default: PROXY protocol v1 explicitly enabled via set_remote_address proxy_protocol: :v1, keep-alive/persistent connections in use between proxy and Puma, and downstream application logic that actually trusts REMOTE_ADDR for security decisions. Where all three hold - for example, Rails apps using request.remote_ip for admin allow-lists or Rack::Attack rate limiting behind HAProxy with keep-alive - the impact is high and should be treated as priority patching.

An attacker sends a normal HTTP request to a public site whose HAProxy or similar proxy forwards traffic to Puma over a keep-alive TCP connection with PROXY protocol v1 enabled. On the same persistent connection, the attacker appends a second request prefixed with a forged PROXY line such as PROXY TCP4 10.0.0.5 ... to impersonate an internal or allow-listed IP, and Puma overwrites REMOTE_ADDR with the spoofed value for the smuggled request. The attacker then reaches IP-restricted admin endpoints, bypasses Rack::Attack throttling, or pollutes audit logs; no public POC was identified at time of analysis, though the analogous go-guerrilla CVE-2025-31135 demonstrates the technique.