Preliminary research

Securing the Supply Chain: Cache Vulnerability in RubyGems

Luke Marshall · Truffle Security

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Explains why a RubyGems API-key endpoint became cacheable only for compressed responses. Gzip changes the response object before ETag middleware, leaving a cache policy that the deployed CDN reuses under a shared encoding key; compression controls reveal token leakage that an ordinary uncompressed diagnostic request misses.

Record

Researcher

Luke Marshall

Published by

Truffle Security

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Vendor security advisory
• Vendor’s detailed write-up

Tags

• cache
• info-leak
• cdn
• supply-chain
• owasp-a06-2021

This page is the archive's own catalogue record. The research is the work of Luke Marshall, first published at the original source. Preserved copies are kept so the citation survives its host.