Technical impact
In the Puma Ruby/Rack web server, enabling PROXY Protocol v1 causes the parser to accumulate incoming data into an internal buffer while it searches for a CRLF that indicates the presence of a PROXY v1 line. If an attacker continuously sends bytes without sending the CRLF terminator, the buffer grows unchecked, forcing the server to repeatedly scan a larger buffer, consuming in‑process memory and CPU until eventual exhaustion, which can interrupt normal operation. This unbounded memory allocation (CWE‑400) results in denial of service.
Affected Systems
The flaw affects Puma versions 5.5.0 through 7.2.0 and earlier 8.x releases up to 8.0.1, when PROXY Protocol v1 is enabled. The issue is resolved in Puma 7.2.1 and 8.0.2.
Risk and Exploitability
The CVSS score of 7.5 indicates a high severity denial‑of‑service risk, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The issue is not listed in the CISA KEV catalog, meaning no widespread, publicly known exploits exist yet. An attacker would need network access to a Puma instance with PROXY Protocol v1 processing enabled and would send data lacking CRLF terminators to trigger the exploit. Although the likelihood of exploitation is low, the potential impact on availability warrants a rapid response.
Debian DLA
Github GHSA