Skip to content

1.0.3 — security patch for 1.x

Choose a tag to compare

View all tags
@ncr ncr released this 25 Sep 12:49
· 6 commits to master since this release
v1.0.3
9886359

Security patch for the 1.x series. Users of rack-proxy 1.0.0–1.0.2 should upgrade to 1.0.3 (or 2.0.0 and later).

Security

  • Return 502 for backend responses with both Transfer-Encoding and Content-Length, preventing an attacker-chosen length from framing the dechunked downstream response (GHSA-42qh-8mx8-7wqm).
  • Close rejected streaming backend connections before reading their body.
  • Strip headers named by all backend Connection fields.

The patch preserves 1.x successful response status types, header representations, request framing, and retry behavior. Versions 2.0.0 and later already reject the ambiguous framing.

Validation

Offline regression tests cover both streaming modes, valid chunked and fixed-length responses, mixed-case headers, repeated Connection fields, and connection cleanup.

Full diff: v1.0.2...v1.0.3

Assets 2
Loading