Puma, a Ruby/Rack web server designed for parallelism, mishandles PROXY protocol v1 headers on persistent connections. From version 5.5.0 up through 7.2.1 and 8.0.2, when set_remote_address proxy_protocol is set to :v1, Puma re‑parses the PROXY header after each keep‑alive request on the same TCP connection. This allows an attacker to inject a second PROXY header and overwrite the REMOTE_ADDR value that applications rely on. The result is source IP spoofing, letting the attacker masquerade as a trusted client and potentially bypass IP‑based controls. The flaw was corrected in Puma 7.2.1 and 8.0.2.

The vulnerability affects Puma web servers from version 5.5.0 up to, but not including, 7.2.1 and 8.0.2. The affected product is the Puma Ruby/Rack web server.

The CVSS score of 7.5 indicates a high severity, but the EPSS score is below 1%, suggesting low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Potential attackers would need network access capable of sending PROXY protocol v1 headers to the remote network connection and does not require local privileges or code execution. However, the impact of successful IP spoofing can be significant for applications relying on client address validation.