StackRadar

CVE-2026-47737

High

Advisory

Published 9 Jun 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.003
18th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
17
of 17,781 indexed, latest versions
Container images
15
deployed by those charts
Fix available
1 of 1
affected package

Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

Carried by container images the latest versions of 17 of 17,781 indexed charts deploy, on 15 images.

Affected packageAffected versionsFixed inImages
pumagem5.5.0, 5.5.2, 5.6.4, 5.6.5+7 more7.2.115
OSV records
GHSA-2vqw-3mp8-cgmx

Charts affected

17 by stars
ChartLatestAffected imagesRadar Score
kubernetes-loggingkubernetes-logging4.8.01 of 6See more

kubernetes-logging kubernetes-logging 4.8.0

1 of the 6 container images this version deploys carry CVE-2026-47737.

Container imageDigestPackageFixed in
opensearchproject/logstash-oss-with-opensearch-output-plugin:8.9.043b0cdaf26ed
puma@5.6.6
7.2.1

Open the chart page →

10,530
mastodondefault-ghVerified publisher0.3.11 of 3See more

mastodon default-gh 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-47737.

Container imageDigestPackageFixed in
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
puma@5.6.5
7.2.1

Open the chart page →

5,056
openprojecthomeenterpriseinc0.5.01 of 1See more

openproject homeenterpriseinc 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-47737.

Container imageDigestPackageFixed in
openproject/community:12.0.2734743d11094
puma@5.5.2
7.2.1

Open the chart page →

6,810
chatwootmaxcrm-chartsVerified publisher1.1.2011 of 4See more

chatwoot maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-47737.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
puma@6.3.1
7.2.1

Open the chart page →

5,940
logstashromanow-helm-chartsVerified publisher1.5.01 of 1See more

logstash romanow-helm-charts 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-47737.

Container imageDigestPackageFixed in
library/logstash:7.17.817a4f64e9cf5
puma@5.6.5
7.2.1

Open the chart page →

7,529
antigenic-docuseal-helm-chartantigenic-docuseal-helm-chartVerified publisher0.2.01 of 1See more

antigenic-docuseal-helm-chart antigenic-docuseal-helm-chart 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-47737.

Container imageDigestPackageFixed in
docuseal/docuseal:2.4.17493fd7f6728
puma@7.2.0
7.2.1

Open the chart page →

2,766
pact-brokercloud-native-toolkit0.3.01 of 1See more

pact-broker cloud-native-toolkit 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-47737.

Container imageDigestPackageFixed in
pactfoundation/pact-broker:2.101.0.0a3021fc42834
puma@5.6.4
7.2.1

Open the chart page →

2,814
elk-stackelk-stack-test1.0.21 of 9See more

elk-stack elk-stack-test 1.0.2

1 of the 9 container images this version deploys carry CVE-2026-47737.

Container imageDigestPackageFixed in
library/logstash:9.1.233eae14f0867
puma@6.6.1
7.2.1

Open the chart page →

2,942
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2026-47737.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-emailservicea1f5cebb5240
puma@6.4.0
7.2.1

Open the chart page →

49,025
docker-registry-browsergtaylor0.4.41 of 1See more

docker-registry-browser gtaylor 0.4.4

1 of the 1 container images this version deploys carry CVE-2026-47737.

Container imageDigestPackageFixed in
klausmeyer/docker-registry-browser:1.4.0bdc4c6b8595b
puma@5.5.0
7.2.1

Open the chart page →

3,564
octoboxhalkeye0.1.11 of 1See more

octobox halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-47737.

Container imageDigestPackageFixed in
octoboxio/octobox:latestd909041c46eb
puma@7.1.0
7.2.1

Open the chart page →

3,255
manyfoldjeffrescVerified publisher1.0.31 of 1See more

manyfold jeffresc 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-47737.

Container imageDigestPackageFixed in
ghcr.io/manyfold3d/manyfold:0.136.0d14ca4d82475
puma@7.2.0
7.2.1

Open the chart page →

1,960
maxcrm-chartsmaxcrm-chartsVerified publisher1.1.2011 of 4See more

maxcrm-charts maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-47737.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
puma@6.3.1
7.2.1

Open the chart page →

5,940
danboorumy0nVerified publisher0.0.21 of 1See more

danbooru my0n 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-47737.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
puma@5.6.4
7.2.1

Open the chart page →

12,791
danbooru-stackmy0nVerified publisher0.0.31 of 4See more

danbooru-stack my0n 0.0.3

1 of the 4 container images this version deploys carry CVE-2026-47737.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
puma@5.6.4
7.2.1

Open the chart page →

12,791
mastodonrivals-spaceVerified publisher3.1.21 of 3See more

mastodon rivals-space 3.1.2

1 of the 3 container images this version deploys carry CVE-2026-47737.

Container imageDigestPackageFixed in
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
puma@5.6.5
7.2.1

Open the chart page →

6,026
maybe-financevicsuferVerified publisher0.2.71 of 3See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-47737.

Container imageDigestPackageFixed in
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
puma@6.6.0
7.2.1

Open the chart page →

10,795

Container images carrying it

15 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
chatwoot/chatwoot:v3.1.0d530ab8c1753
puma@6.3.1
7.2.1
2
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
puma@5.6.4
7.2.1
2
docuseal/docuseal:2.4.17493fd7f6728
puma@7.2.0
7.2.1
1
klausmeyer/docker-registry-browser:1.4.0bdc4c6b8595b
puma@5.5.0
7.2.1
1
library/logstash:7.17.817a4f64e9cf5
puma@5.6.5
7.2.1
1
library/logstash:9.1.233eae14f0867
puma@6.6.1
7.2.1
1
octoboxio/octobox:latestd909041c46eb
puma@7.1.0
7.2.1
1
openproject/community:12.0.2734743d11094
puma@5.5.2
7.2.1
1
opensearchproject/logstash-oss-with-opensearch-output-plugin:8.9.043b0cdaf26ed
puma@5.6.6
7.2.1
1
pactfoundation/pact-broker:2.101.0.0a3021fc42834
puma@5.6.4
7.2.1
1
ghcr.io/manyfold3d/manyfold:0.136.0d14ca4d82475
puma@7.2.0
7.2.1
1
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
puma@5.6.5
7.2.1
1
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
puma@6.6.0
7.2.1
1
ghcr.io/open-telemetry/demo:1.12.0-emailservicea1f5cebb5240
puma@6.4.0
7.2.1
1
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
puma@5.6.5
7.2.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.