puma 7.2.0 → 7.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cf20ee32c008736a0ecf6072333f9204d0845fe98c65de34cafed9d6cbcbf407
-  data.tar.gz: 8dc8d19a8648c5db1f64ae0f84e5c97c0db890fa92183fbb6372ae209e56f449
+  metadata.gz: eef4284ed113815501c9e01586a0a0fcd8d2f20e23376598e176effb4b6146a0
+  data.tar.gz: 83699a936ba02fbc03c2b2b10306d949f0525713d4a0cc3bbee44ecca6d71664
 SHA512:
-  metadata.gz: 18033fd5ca12182ac421125433082f1b919deb43abc3a525c45db1d256c65e557feb273e785798d3606fd12638140ba1fba2e3189a2ca70855f59c074ba63ea4
-  data.tar.gz: 6c6bad3a44ad2aaefde1a7d4aab2d50dcdb7d10333f2efa05cf0031aaa4ad702226b8038155fe78b2689e7e38b51fb8bcd26c3d643f3a1b1bbcdb9293f65d16c
+  metadata.gz: a3ae91d6a0b359f450801765ed5cecb8f84204b115609ef41594812597f82211ba28c556ca5139a7bfc2ec9e68b6187a0fec481c228a0aeb40ca0ec25c57d29d
+  data.tar.gz: 289b4a1da3eaa061df1a0f7f8d7b5fce12d74e211a23fae0e7b7eae24fab85692b6636ed687ef8f4b833f7ff5ad975f3c17575f1061e1a4dc30ba517125b1788

data/History.md

@@ -1,3 +1,9 @@
+## 7.2.1 / 2026-05-27
+
+* Bugfixes
+  * Limit and anchor PROXY protocol v1 parsing to prevent abuse via crafted inputs ([#3947])
+  * Parse PROXY protocol only once per connection to prevent injection on keep-alive requests ([#3947])
+
 ## 7.2.0 / 2026-01-20
 
 * Features
@@ -2294,6 +2300,7 @@ be added back in a future date when a java Puma::MiniSSL is added.
 * Bugfixes
   * Your bugfix goes here <Most recent on the top, like GitHub> (#Github Number)
 
+[#3947]:https://github.com/puma/puma/pull/3947     "PR by Nate Berkopec, merged 2026-05-26"
 [#3863]:https://github.com/puma/puma/pull/3863     "PR by Nate Berkopec, merged 2026-01-20"
 [#3861]:https://github.com/puma/puma/pull/3861     "PR by MSP-Greg, merged 2026-01-20"
 [#3860]:https://github.com/puma/puma/pull/3860     "PR by MSP-Greg, merged 2026-01-16"

data/lib/puma/client.rb

@@ -157,7 +157,7 @@ module Puma
       @parser.reset
       @io_buffer.reset
       @read_header = true
-      @read_proxy = !!@expect_proxy_proto
+      @read_proxy = !!@expect_proxy_proto && @requests_served.zero?
       @env = @proto_env.dup
       @parsed_bytes = 0
       @ready = false
@@ -211,20 +211,36 @@ module Puma
     def try_to_parse_proxy_protocol
       if @read_proxy
         if @expect_proxy_proto == :v1
-          if @buffer.include? "\r\n"
-            if md = PROXY_PROTOCOL_V1_REGEX.match(@buffer)
-              if md[1]
-                @peerip = md[1].split(" ")[0]
+          crlf_index = @buffer.index "\r\n"
+
+          unless crlf_index
+            if "PROXY ".start_with? @buffer
+              return false
+            elsif @buffer.start_with? "PROXY "
+              if @buffer.bytesize >= PROXY_PROTOCOL_V1_MAX_LENGTH
+                raise ConnectionError, "PROXY protocol v1 line is too long"
               end
-              @buffer = md.post_match
+              return false
             end
-            # if the buffer has a \r\n but doesn't have a PROXY protocol
-            # request, this is just HTTP from a non-PROXY client; move on
+
             @read_proxy = false
-            return @buffer.size > 0
-          else
-            return false
+            return true
+          end
+
+          if @buffer.start_with?("PROXY ") && crlf_index + 2 > PROXY_PROTOCOL_V1_MAX_LENGTH
+            raise ConnectionError, "PROXY protocol v1 line is too long"
+          end
+
+          if md = PROXY_PROTOCOL_V1_REGEX.match(@buffer)
+            if md[1]
+              @peerip = md[1].split(" ")[0]
+            end
+            @buffer = md.post_match
           end
+          # if the buffer has a \r\n but doesn't have a PROXY protocol
+          # request, this is just HTTP from a non-PROXY client; move on
+          @read_proxy = false
+          return @buffer.size > 0
         end
       end
       true

data/lib/puma/const.rb

@@ -100,7 +100,7 @@ module Puma
   # too taxing on performance.
   module Const
 
-    PUMA_VERSION = VERSION = "7.2.0"
+    PUMA_VERSION = VERSION = "7.2.1"
     CODE_NAME = "On The Corner"
 
     PUMA_SERVER_STRING = ["puma", PUMA_VERSION, CODE_NAME].join(" ").freeze
@@ -291,7 +291,8 @@ module Puma
     # Banned keys of response header
     BANNED_HEADER_KEY = /\A(rack\.|status\z)/.freeze
 
-    PROXY_PROTOCOL_V1_REGEX = /^PROXY (?:TCP4|TCP6|UNKNOWN) ([^\r]+)\r\n/.freeze
+    PROXY_PROTOCOL_V1_REGEX = /\APROXY (?:TCP4|TCP6|UNKNOWN) ([^\r]+)\r\n/.freeze
+    PROXY_PROTOCOL_V1_MAX_LENGTH = 107
 
     # All constants are prefixed with `PIPE_` to avoid name collisions.
     module PipeRequest

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: puma
 version: !ruby/object:Gem::Version
-  version: 7.2.0
+  version: 7.2.1
 platform: ruby
 authors:
 - Evan Phoenix
@@ -146,7 +146,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.6
 specification_version: 4
 summary: A Ruby/Rack web server built for parallelism.
 test_files: []