Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

A vulnerability in the Puma web server, affecting versions 5.5.0 prior to 7.2.1 and 8.0.2, allows for remote memory exhaustion when PROXY protocol v1 support is enabled. The server reads incoming data into an internal buffer, waiting for a carriage return and line feed (CRLF) to identify PROXY v1 lines. An attacker can exploit this by sending bytes without CRLF, causing unbounded memory growth and increased CPU usage as the server scans the expanding buffer. This issue can lead to out-of-memory conditions or degraded availability.

Impact

Exploitation of this vulnerability causes significant in-process memory growth, which can lead to out-of-memory conditions and degraded availability on the affected server.

Reproduction

To reproduce this vulnerability, enable PROXY protocol v1 support in the Puma server configuration. Then, open a TCP connection to the server and continuously send bytes without including CRLF. The server will append these bytes to its internal buffer, leading to memory exhaustion.

Remediation

Users should upgrade to Puma versions 7.2.1 or 8.0.2. If the PROXY protocol v1 parsing is not needed, it can be disabled by removing or commenting out the 'set_remote_address proxy_protocol: :v1' line in the server configuration. For added security, restrict direct network access to Puma listeners using PROXY protocol, allowing only trusted load balancers or reverse proxies to connect and blocking arbitrary client TCP access with firewall or security group rules.