Preliminary research
Securing the Supply Chain: Cache Vulnerability in RubyGems
AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.
Explains why a RubyGems API-key endpoint became cacheable only for compressed responses. Gzip changes the response object before ETag middleware, leaving a cache policy that the deployed CDN reuses under a shared encoding key; compression controls reveal token leakage that an ordinary uncompressed diagnostic request misses.
Record
- Researcher
- Luke Marshall
- Published by
- Truffle Security
- Topic
- Supply
In the archive
Related sources
- RubyGems legacy API-key cache leak Advisory
- RubyGems legacy API key leak Advisory
Tags
This page is the archive's own catalogue record. The research is the work of Luke Marshall, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .