Timeline

• Jun 16, 2020 CVE Published
• Jun 16, 2020 PoC Published

References

• Rack parses encoded cookie names allowing an attacker to send malicious `__Host-` and `__Secure-` prefixed cookies advisory