Puma versions 5.5.0 through before 7.2.1 and 8.0.0 through before 8.0.2 with PROXY protocol v1 parsing enabled are vulnerable to remote memory exhaustion. An unauthenticated attacker can open a TCP connection and send bytes without CRLF, causing Puma to continuously append to an internal buffer, leading to unbounded memory growth and CPU usage. This may result in process or container out-of-memory conditions or degraded availability. The vulnerability only affects Puma servers configured with 'set_remote_address proxy_protocol: :v1'.