#4004·puma

HeaderHash clear and copies can retain a stale case index

Author: OskarEichlerCreated Aug 30, 2026Updated Aug 30, 2026

Puma::Util::HeaderHash keeps an internal lowercase-to-original-name index in @names, but inherited Hash#clear does not clear it and inherited shallow dup shares it. After clear, include? can claim a removed header exists; mutating a duplicate or overlapping merge can corrupt case-insensitive lookups in the original.

A narrow source fix adds initialize_copy to duplicate @names and clear to reset both the hash and index while preserving the normal frozen-hash error behavior.

A standalone model covers clear, duplicate isolation, overlapping merge, case-insensitive lookup, and frozen instances. Puma 8.0.2/current fail the lifecycle checks; the candidate passes all five.

Local verification: focused upstream test_response_header:test_rack_server passes 28 runs /67 assertions; the changed file passes Ruby syntax and project RuboCop. I am filing issue-first because CONTRIBUTING asks code fixes to include tests.