Skip to content

Bump puma from 8.0.1 to 8.0.2#993

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/puma-8.0.2
Open

Bump puma from 8.0.1 to 8.0.2#993
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/puma-8.0.2

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 27, 2026

Bumps puma from 8.0.1 to 8.0.2.

Release notes

Sourced from puma's releases.

v8.0.2

  • Bugfixes
    • Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)
    • Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)

Security advisories

Changelog

Sourced from puma's changelog.

8.0.2 / 2026-05-27

  • Bugfixes
    • Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)
    • Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [puma](https://github.com/puma/puma) from 8.0.1 to 8.0.2.
- [Release notes](https://github.com/puma/puma/releases)
- [Changelog](https://github.com/puma/puma/blob/main/History.md)
- [Commits](puma/puma@v8.0.1...v8.0.2)

---
updated-dependencies:
- dependency-name: puma
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies ruby Pull requests that update Ruby code labels May 27, 2026
@github-actions
Copy link
Copy Markdown
Contributor

4 similar comments
@github-actions
Copy link
Copy Markdown
Contributor

@github-actions
Copy link
Copy Markdown
Contributor

@github-actions
Copy link
Copy Markdown
Contributor

@github-actions
Copy link
Copy Markdown
Contributor

@github-actions
Copy link
Copy Markdown
Contributor

gem compare puma 8.0.1 8.0.2

Compared versions: ["8.0.1", "8.0.2"]
  DIFFERENT require_paths:
    8.0.1: ["/opt/hostedtoolcache/Ruby/4.0.5/x64/lib/ruby/gems/4.0.0/extensions/x86_64-linux/4.0.0/puma-8.0.1", "lib"]
    8.0.2: ["/opt/hostedtoolcache/Ruby/4.0.5/x64/lib/ruby/gems/4.0.0/extensions/x86_64-linux/4.0.0/puma-8.0.2", "lib"]
  DIFFERENT version:
    8.0.1: 8.0.1
    8.0.2: 8.0.2
  DIFFERENT files:
    8.0.1->8.0.2:
      * Changed:
            History.md +7/-0
            lib/puma/client.rb +27/-11
            lib/puma/const.rb +3/-2

4 similar comments
@github-actions
Copy link
Copy Markdown
Contributor

gem compare puma 8.0.1 8.0.2

Compared versions: ["8.0.1", "8.0.2"]
  DIFFERENT require_paths:
    8.0.1: ["/opt/hostedtoolcache/Ruby/4.0.5/x64/lib/ruby/gems/4.0.0/extensions/x86_64-linux/4.0.0/puma-8.0.1", "lib"]
    8.0.2: ["/opt/hostedtoolcache/Ruby/4.0.5/x64/lib/ruby/gems/4.0.0/extensions/x86_64-linux/4.0.0/puma-8.0.2", "lib"]
  DIFFERENT version:
    8.0.1: 8.0.1
    8.0.2: 8.0.2
  DIFFERENT files:
    8.0.1->8.0.2:
      * Changed:
            History.md +7/-0
            lib/puma/client.rb +27/-11
            lib/puma/const.rb +3/-2

@github-actions
Copy link
Copy Markdown
Contributor

gem compare puma 8.0.1 8.0.2

Compared versions: ["8.0.1", "8.0.2"]
  DIFFERENT require_paths:
    8.0.1: ["/opt/hostedtoolcache/Ruby/4.0.5/x64/lib/ruby/gems/4.0.0/extensions/x86_64-linux/4.0.0/puma-8.0.1", "lib"]
    8.0.2: ["/opt/hostedtoolcache/Ruby/4.0.5/x64/lib/ruby/gems/4.0.0/extensions/x86_64-linux/4.0.0/puma-8.0.2", "lib"]
  DIFFERENT version:
    8.0.1: 8.0.1
    8.0.2: 8.0.2
  DIFFERENT files:
    8.0.1->8.0.2:
      * Changed:
            History.md +7/-0
            lib/puma/client.rb +27/-11
            lib/puma/const.rb +3/-2

@github-actions
Copy link
Copy Markdown
Contributor

gem compare puma 8.0.1 8.0.2

Compared versions: ["8.0.1", "8.0.2"]
  DIFFERENT require_paths:
    8.0.1: ["/opt/hostedtoolcache/Ruby/4.0.5/x64/lib/ruby/gems/4.0.0/extensions/x86_64-linux/4.0.0/puma-8.0.1", "lib"]
    8.0.2: ["/opt/hostedtoolcache/Ruby/4.0.5/x64/lib/ruby/gems/4.0.0/extensions/x86_64-linux/4.0.0/puma-8.0.2", "lib"]
  DIFFERENT version:
    8.0.1: 8.0.1
    8.0.2: 8.0.2
  DIFFERENT files:
    8.0.1->8.0.2:
      * Changed:
            History.md +7/-0
            lib/puma/client.rb +27/-11
            lib/puma/const.rb +3/-2

@github-actions
Copy link
Copy Markdown
Contributor

gem compare puma 8.0.1 8.0.2

Compared versions: ["8.0.1", "8.0.2"]
  DIFFERENT require_paths:
    8.0.1: ["/opt/hostedtoolcache/Ruby/4.0.5/x64/lib/ruby/gems/4.0.0/extensions/x86_64-linux/4.0.0/puma-8.0.1", "lib"]
    8.0.2: ["/opt/hostedtoolcache/Ruby/4.0.5/x64/lib/ruby/gems/4.0.0/extensions/x86_64-linux/4.0.0/puma-8.0.2", "lib"]
  DIFFERENT version:
    8.0.1: 8.0.1
    8.0.2: 8.0.2
  DIFFERENT files:
    8.0.1->8.0.2:
      * Changed:
            History.md +7/-0
            lib/puma/client.rb +27/-11
            lib/puma/const.rb +3/-2

@github-actions
Copy link
Copy Markdown
Contributor

gem compare --diff puma 8.0.1 8.0.2

Compared versions: ["8.0.1", "8.0.2"]
  DIFFERENT files:
    8.0.1->8.0.2:
      * Changed:
        History.md
                --- /tmp/d20260527-689-jmwfj2/puma-8.0.1/History.md	2026-05-27 04:36:11.517774249 +0000
                +++ /tmp/d20260527-689-jmwfj2/puma-8.0.2/History.md	2026-05-27 04:36:11.531774467 +0000
                @@ -0,0 +1,6 @@
                +## 8.0.2 / 2026-05-27
                +
                +* Bugfixes
                +  * Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies ([#3944])
                +  * Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections ([#3944])
                +
                @@ -2337,0 +2344 @@
                +[#3944]:https://github.com/puma/puma/pull/3944     "PR by Nate Berkopec, merged 2026-05-26"
        lib/puma/client.rb
                --- /tmp/d20260527-689-jmwfj2/puma-8.0.1/lib/puma/client.rb	2026-05-27 04:36:11.524774358 +0000
                +++ /tmp/d20260527-689-jmwfj2/puma-8.0.2/lib/puma/client.rb	2026-05-27 04:36:11.537774561 +0000
                @@ -166 +166 @@
                -      @read_proxy = !!@expect_proxy_proto
                +      @read_proxy = !!@expect_proxy_proto && @requests_served.zero?
                @@ -216,4 +216,8 @@
                -          if @buffer.include? "\r\n"
                -            if md = PROXY_PROTOCOL_V1_REGEX.match(@buffer)
                -              if md[1]
                -                @peerip = md[1].split(" ")[0]
                +          crlf_index = @buffer.index "\r\n"
                +
                +          unless crlf_index
                +            if "PROXY ".start_with? @buffer
                +              return false
                +            elsif @buffer.start_with? "PROXY "
                +              if @buffer.bytesize >= PROXY_PROTOCOL_V1_MAX_LENGTH
                +                raise ConnectionError, "PROXY protocol v1 line is too long"
                @@ -221 +225 @@
                -              @buffer = md.post_match
                +              return false
                @@ -223,2 +227 @@
                -            # if the buffer has a \r\n but doesn't have a PROXY protocol
                -            # request, this is just HTTP from a non-PROXY client; move on
                +
                @@ -226,3 +229,12 @@
                -            return @buffer.size > 0
                -          else
                -            return false
                +            return true
                +          end
                +
                +          if @buffer.start_with?("PROXY ") && crlf_index + 2 > PROXY_PROTOCOL_V1_MAX_LENGTH
                +            raise ConnectionError, "PROXY protocol v1 line is too long"
                +          end
                +
                +          if md = PROXY_PROTOCOL_V1_REGEX.match(@buffer)
                +            if md[1]
                +              @peerip = md[1].split(" ")[0]
                +            end
                +            @buffer = md.post_match
                @@ -229,0 +242,4 @@
                +          # if the buffer has a \r\n but doesn't have a PROXY protocol
                +          # request, this is just HTTP from a non-PROXY client; move on
                +          @read_proxy = false
                +          return @buffer.size > 0
        lib/puma/const.rb
                --- /tmp/d20260527-689-jmwfj2/puma-8.0.1/lib/puma/const.rb	2026-05-27 04:36:11.525774374 +0000
                +++ /tmp/d20260527-689-jmwfj2/puma-8.0.2/lib/puma/const.rb	2026-05-27 04:36:11.538774576 +0000
                @@ -103 +103 @@
                -    PUMA_VERSION = VERSION = "8.0.1"
                +    PUMA_VERSION = VERSION = "8.0.2"
                @@ -294 +294,2 @@
                -    PROXY_PROTOCOL_V1_REGEX = /^PROXY (?:TCP4|TCP6|UNKNOWN) ([^\r]+)\r\n/.freeze
                +    PROXY_PROTOCOL_V1_REGEX = /\APROXY (?:TCP4|TCP6|UNKNOWN) ([^\r]+)\r\n/.freeze
                +    PROXY_PROTOCOL_V1_MAX_LENGTH = 107

@github-actions
Copy link
Copy Markdown
Contributor

gem compare --diff puma 8.0.1 8.0.2

Compared versions: ["8.0.1", "8.0.2"]
  DIFFERENT files:
    8.0.1->8.0.2:
      * Changed:
        History.md
                --- /tmp/d20260527-673-c6md9w/puma-8.0.1/History.md	2026-05-27 04:36:12.422404886 +0000
                +++ /tmp/d20260527-673-c6md9w/puma-8.0.2/History.md	2026-05-27 04:36:12.437405020 +0000
                @@ -0,0 +1,6 @@
                +## 8.0.2 / 2026-05-27
                +
                +* Bugfixes
                +  * Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies ([#3944])
                +  * Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections ([#3944])
                +
                @@ -2337,0 +2344 @@
                +[#3944]:https://github.com/puma/puma/pull/3944     "PR by Nate Berkopec, merged 2026-05-26"
        lib/puma/client.rb
                --- /tmp/d20260527-673-c6md9w/puma-8.0.1/lib/puma/client.rb	2026-05-27 04:36:12.430404958 +0000
                +++ /tmp/d20260527-673-c6md9w/puma-8.0.2/lib/puma/client.rb	2026-05-27 04:36:12.445405091 +0000
                @@ -166 +166 @@
                -      @read_proxy = !!@expect_proxy_proto
                +      @read_proxy = !!@expect_proxy_proto && @requests_served.zero?
                @@ -216,4 +216,8 @@
                -          if @buffer.include? "\r\n"
                -            if md = PROXY_PROTOCOL_V1_REGEX.match(@buffer)
                -              if md[1]
                -                @peerip = md[1].split(" ")[0]
                +          crlf_index = @buffer.index "\r\n"
                +
                +          unless crlf_index
                +            if "PROXY ".start_with? @buffer
                +              return false
                +            elsif @buffer.start_with? "PROXY "
                +              if @buffer.bytesize >= PROXY_PROTOCOL_V1_MAX_LENGTH
                +                raise ConnectionError, "PROXY protocol v1 line is too long"
                @@ -221 +225 @@
                -              @buffer = md.post_match
                +              return false
                @@ -223,2 +227 @@
                -            # if the buffer has a \r\n but doesn't have a PROXY protocol
                -            # request, this is just HTTP from a non-PROXY client; move on
                +
                @@ -226,3 +229,12 @@
                -            return @buffer.size > 0
                -          else
                -            return false
                +            return true
                +          end
                +
                +          if @buffer.start_with?("PROXY ") && crlf_index + 2 > PROXY_PROTOCOL_V1_MAX_LENGTH
                +            raise ConnectionError, "PROXY protocol v1 line is too long"
                +          end
                +
                +          if md = PROXY_PROTOCOL_V1_REGEX.match(@buffer)
                +            if md[1]
                +              @peerip = md[1].split(" ")[0]
                +            end
                +            @buffer = md.post_match
                @@ -229,0 +242,4 @@
                +          # if the buffer has a \r\n but doesn't have a PROXY protocol
                +          # request, this is just HTTP from a non-PROXY client; move on
                +          @read_proxy = false
                +          return @buffer.size > 0
        lib/puma/const.rb
                --- /tmp/d20260527-673-c6md9w/puma-8.0.1/lib/puma/const.rb	2026-05-27 04:36:12.431404966 +0000
                +++ /tmp/d20260527-673-c6md9w/puma-8.0.2/lib/puma/const.rb	2026-05-27 04:36:12.446405100 +0000
                @@ -103 +103 @@
                -    PUMA_VERSION = VERSION = "8.0.1"
                +    PUMA_VERSION = VERSION = "8.0.2"
                @@ -294 +294,2 @@
                -    PROXY_PROTOCOL_V1_REGEX = /^PROXY (?:TCP4|TCP6|UNKNOWN) ([^\r]+)\r\n/.freeze
                +    PROXY_PROTOCOL_V1_REGEX = /\APROXY (?:TCP4|TCP6|UNKNOWN) ([^\r]+)\r\n/.freeze
                +    PROXY_PROTOCOL_V1_MAX_LENGTH = 107

@github-actions
Copy link
Copy Markdown
Contributor

gem compare --diff puma 8.0.1 8.0.2

Compared versions: ["8.0.1", "8.0.2"]
  DIFFERENT files:
    8.0.1->8.0.2:
      * Changed:
        History.md
                --- /tmp/d20260527-682-awfanx/puma-8.0.1/History.md	2026-05-27 04:36:23.428700885 +0000
                +++ /tmp/d20260527-682-awfanx/puma-8.0.2/History.md	2026-05-27 04:36:23.458701144 +0000
                @@ -0,0 +1,6 @@
                +## 8.0.2 / 2026-05-27
                +
                +* Bugfixes
                +  * Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies ([#3944])
                +  * Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections ([#3944])
                +
                @@ -2337,0 +2344 @@
                +[#3944]:https://github.com/puma/puma/pull/3944     "PR by Nate Berkopec, merged 2026-05-26"
        lib/puma/client.rb
                --- /tmp/d20260527-682-awfanx/puma-8.0.1/lib/puma/client.rb	2026-05-27 04:36:23.445701032 +0000
                +++ /tmp/d20260527-682-awfanx/puma-8.0.2/lib/puma/client.rb	2026-05-27 04:36:23.467701221 +0000
                @@ -166 +166 @@
                -      @read_proxy = !!@expect_proxy_proto
                +      @read_proxy = !!@expect_proxy_proto && @requests_served.zero?
                @@ -216,4 +216,8 @@
                -          if @buffer.include? "\r\n"
                -            if md = PROXY_PROTOCOL_V1_REGEX.match(@buffer)
                -              if md[1]
                -                @peerip = md[1].split(" ")[0]
                +          crlf_index = @buffer.index "\r\n"
                +
                +          unless crlf_index
                +            if "PROXY ".start_with? @buffer
                +              return false
                +            elsif @buffer.start_with? "PROXY "
                +              if @buffer.bytesize >= PROXY_PROTOCOL_V1_MAX_LENGTH
                +                raise ConnectionError, "PROXY protocol v1 line is too long"
                @@ -221 +225 @@
                -              @buffer = md.post_match
                +              return false
                @@ -223,2 +227 @@
                -            # if the buffer has a \r\n but doesn't have a PROXY protocol
                -            # request, this is just HTTP from a non-PROXY client; move on
                +
                @@ -226,3 +229,12 @@
                -            return @buffer.size > 0
                -          else
                -            return false
                +            return true
                +          end
                +
                +          if @buffer.start_with?("PROXY ") && crlf_index + 2 > PROXY_PROTOCOL_V1_MAX_LENGTH
                +            raise ConnectionError, "PROXY protocol v1 line is too long"
                +          end
                +
                +          if md = PROXY_PROTOCOL_V1_REGEX.match(@buffer)
                +            if md[1]
                +              @peerip = md[1].split(" ")[0]
                +            end
                +            @buffer = md.post_match
                @@ -229,0 +242,4 @@
                +          # if the buffer has a \r\n but doesn't have a PROXY protocol
                +          # request, this is just HTTP from a non-PROXY client; move on
                +          @read_proxy = false
                +          return @buffer.size > 0
        lib/puma/const.rb
                --- /tmp/d20260527-682-awfanx/puma-8.0.1/lib/puma/const.rb	2026-05-27 04:36:23.447701049 +0000
                +++ /tmp/d20260527-682-awfanx/puma-8.0.2/lib/puma/const.rb	2026-05-27 04:36:23.468701230 +0000
                @@ -103 +103 @@
                -    PUMA_VERSION = VERSION = "8.0.1"
                +    PUMA_VERSION = VERSION = "8.0.2"
                @@ -294 +294,2 @@
                -    PROXY_PROTOCOL_V1_REGEX = /^PROXY (?:TCP4|TCP6|UNKNOWN) ([^\r]+)\r\n/.freeze
                +    PROXY_PROTOCOL_V1_REGEX = /\APROXY (?:TCP4|TCP6|UNKNOWN) ([^\r]+)\r\n/.freeze
                +    PROXY_PROTOCOL_V1_MAX_LENGTH = 107

@github-actions
Copy link
Copy Markdown
Contributor

gem compare --diff puma 8.0.1 8.0.2

Compared versions: ["8.0.1", "8.0.2"]
  DIFFERENT files:
    8.0.1->8.0.2:
      * Changed:
        History.md
                --- /tmp/d20260527-719-i2laz2/puma-8.0.1/History.md	2026-05-27 04:36:32.823930042 +0000
                +++ /tmp/d20260527-719-i2laz2/puma-8.0.2/History.md	2026-05-27 04:36:32.835929942 +0000
                @@ -0,0 +1,6 @@
                +## 8.0.2 / 2026-05-27
                +
                +* Bugfixes
                +  * Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies ([#3944])
                +  * Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections ([#3944])
                +
                @@ -2337,0 +2344 @@
                +[#3944]:https://github.com/puma/puma/pull/3944     "PR by Nate Berkopec, merged 2026-05-26"
        lib/puma/client.rb
                --- /tmp/d20260527-719-i2laz2/puma-8.0.1/lib/puma/client.rb	2026-05-27 04:36:32.829929992 +0000
                +++ /tmp/d20260527-719-i2laz2/puma-8.0.2/lib/puma/client.rb	2026-05-27 04:36:32.841929892 +0000
                @@ -166 +166 @@
                -      @read_proxy = !!@expect_proxy_proto
                +      @read_proxy = !!@expect_proxy_proto && @requests_served.zero?
                @@ -216,4 +216,8 @@
                -          if @buffer.include? "\r\n"
                -            if md = PROXY_PROTOCOL_V1_REGEX.match(@buffer)
                -              if md[1]
                -                @peerip = md[1].split(" ")[0]
                +          crlf_index = @buffer.index "\r\n"
                +
                +          unless crlf_index
                +            if "PROXY ".start_with? @buffer
                +              return false
                +            elsif @buffer.start_with? "PROXY "
                +              if @buffer.bytesize >= PROXY_PROTOCOL_V1_MAX_LENGTH
                +                raise ConnectionError, "PROXY protocol v1 line is too long"
                @@ -221 +225 @@
                -              @buffer = md.post_match
                +              return false
                @@ -223,2 +227 @@
                -            # if the buffer has a \r\n but doesn't have a PROXY protocol
                -            # request, this is just HTTP from a non-PROXY client; move on
                +
                @@ -226,3 +229,12 @@
                -            return @buffer.size > 0
                -          else
                -            return false
                +            return true
                +          end
                +
                +          if @buffer.start_with?("PROXY ") && crlf_index + 2 > PROXY_PROTOCOL_V1_MAX_LENGTH
                +            raise ConnectionError, "PROXY protocol v1 line is too long"
                +          end
                +
                +          if md = PROXY_PROTOCOL_V1_REGEX.match(@buffer)
                +            if md[1]
                +              @peerip = md[1].split(" ")[0]
                +            end
                +            @buffer = md.post_match
                @@ -229,0 +242,4 @@
                +          # if the buffer has a \r\n but doesn't have a PROXY protocol
                +          # request, this is just HTTP from a non-PROXY client; move on
                +          @read_proxy = false
                +          return @buffer.size > 0
        lib/puma/const.rb
                --- /tmp/d20260527-719-i2laz2/puma-8.0.1/lib/puma/const.rb	2026-05-27 04:36:32.830929984 +0000
                +++ /tmp/d20260527-719-i2laz2/puma-8.0.2/lib/puma/const.rb	2026-05-27 04:36:32.842929884 +0000
                @@ -103 +103 @@
                -    PUMA_VERSION = VERSION = "8.0.1"
                +    PUMA_VERSION = VERSION = "8.0.2"
                @@ -294 +294,2 @@
                -    PROXY_PROTOCOL_V1_REGEX = /^PROXY (?:TCP4|TCP6|UNKNOWN) ([^\r]+)\r\n/.freeze
                +    PROXY_PROTOCOL_V1_REGEX = /\APROXY (?:TCP4|TCP6|UNKNOWN) ([^\r]+)\r\n/.freeze
                +    PROXY_PROTOCOL_V1_MAX_LENGTH = 107

@github-actions
Copy link
Copy Markdown
Contributor

gem compare --diff puma 8.0.1 8.0.2

Compared versions: ["8.0.1", "8.0.2"]
  DIFFERENT files:
    8.0.1->8.0.2:
      * Changed:
        History.md
                --- /tmp/d20260527-701-t3okc/puma-8.0.1/History.md	2026-05-27 04:36:35.454548292 +0000
                +++ /tmp/d20260527-701-t3okc/puma-8.0.2/History.md	2026-05-27 04:36:35.469548455 +0000
                @@ -0,0 +1,6 @@
                +## 8.0.2 / 2026-05-27
                +
                +* Bugfixes
                +  * Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies ([#3944])
                +  * Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections ([#3944])
                +
                @@ -2337,0 +2344 @@
                +[#3944]:https://github.com/puma/puma/pull/3944     "PR by Nate Berkopec, merged 2026-05-26"
        lib/puma/client.rb
                --- /tmp/d20260527-701-t3okc/puma-8.0.1/lib/puma/client.rb	2026-05-27 04:36:35.462548379 +0000
                +++ /tmp/d20260527-701-t3okc/puma-8.0.2/lib/puma/client.rb	2026-05-27 04:36:35.476548531 +0000
                @@ -166 +166 @@
                -      @read_proxy = !!@expect_proxy_proto
                +      @read_proxy = !!@expect_proxy_proto && @requests_served.zero?
                @@ -216,4 +216,8 @@
                -          if @buffer.include? "\r\n"
                -            if md = PROXY_PROTOCOL_V1_REGEX.match(@buffer)
                -              if md[1]
                -                @peerip = md[1].split(" ")[0]
                +          crlf_index = @buffer.index "\r\n"
                +
                +          unless crlf_index
                +            if "PROXY ".start_with? @buffer
                +              return false
                +            elsif @buffer.start_with? "PROXY "
                +              if @buffer.bytesize >= PROXY_PROTOCOL_V1_MAX_LENGTH
                +                raise ConnectionError, "PROXY protocol v1 line is too long"
                @@ -221 +225 @@
                -              @buffer = md.post_match
                +              return false
                @@ -223,2 +227 @@
                -            # if the buffer has a \r\n but doesn't have a PROXY protocol
                -            # request, this is just HTTP from a non-PROXY client; move on
                +
                @@ -226,3 +229,12 @@
                -            return @buffer.size > 0
                -          else
                -            return false
                +            return true
                +          end
                +
                +          if @buffer.start_with?("PROXY ") && crlf_index + 2 > PROXY_PROTOCOL_V1_MAX_LENGTH
                +            raise ConnectionError, "PROXY protocol v1 line is too long"
                +          end
                +
                +          if md = PROXY_PROTOCOL_V1_REGEX.match(@buffer)
                +            if md[1]
                +              @peerip = md[1].split(" ")[0]
                +            end
                +            @buffer = md.post_match
                @@ -229,0 +242,4 @@
                +          # if the buffer has a \r\n but doesn't have a PROXY protocol
                +          # request, this is just HTTP from a non-PROXY client; move on
                +          @read_proxy = false
                +          return @buffer.size > 0
        lib/puma/const.rb
                --- /tmp/d20260527-701-t3okc/puma-8.0.1/lib/puma/const.rb	2026-05-27 04:36:35.464548400 +0000
                +++ /tmp/d20260527-701-t3okc/puma-8.0.2/lib/puma/const.rb	2026-05-27 04:36:35.477548542 +0000
                @@ -103 +103 @@
                -    PUMA_VERSION = VERSION = "8.0.1"
                +    PUMA_VERSION = VERSION = "8.0.2"
                @@ -294 +294,2 @@
                -    PROXY_PROTOCOL_V1_REGEX = /^PROXY (?:TCP4|TCP6|UNKNOWN) ([^\r]+)\r\n/.freeze
                +    PROXY_PROTOCOL_V1_REGEX = /\APROXY (?:TCP4|TCP6|UNKNOWN) ([^\r]+)\r\n/.freeze
                +    PROXY_PROTOCOL_V1_MAX_LENGTH = 107

Comment thread Gemfile.lock
bake (0.24.1) sha256=8bfac7e61514b17720e3b13cf6a5e122243f43123c6802707b150904bec5f4c7
base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
bigdecimal (4.1.2) sha256=53d217666027eab4280346fba98e7d5b66baaae1b9c3c1c0ffe89d48188a3fbd
bundler (4.0.12) sha256=7f8b757d28dfb636e7b24fba2344ac6dd13b5b24f4b46d62573d483f211825ac
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies ruby Pull requests that update Ruby code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant