Preliminary research

Securing the Supply Chain: Cache Vulnerability in RubyGems

Luke Marshall · Truffle Security

AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Explains why a RubyGems API-key endpoint became cacheable only for compressed responses. Gzip changes the response object before ETag middleware, leaving a cache policy that the deployed CDN reuses under a shared encoding key; compression controls reveal token leakage that an ordinary uncompressed diagnostic request misses.

Record

Researcher

Luke Marshall

Published by

Truffle Security

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Vendor security advisory
• Vendor’s detailed write-up

Tags

• cache
• info-leak
• cdn
• supply-chain
• owasp-a06-2021

This page is the archive's own catalogue record. The research is the work of Luke Marshall, first published at the original source. Preserved copies are kept so the citation survives its host.