from/prod
← All companies

THE COMPANY INDEX TRACKED BLOG

Crystal

Ideas, decisions, and lessons from the team.

crystal-lang.org (opens on the source site)LinkedIn X
4Posts tracked
3 months agoLatest publication
0.3Posts / month over the last 12 months

Latest writing

4 of 4 posts

Post Mortem: HTTP Request Smuggling Vulnerability (opens on the source site)

On 12 April 2026, we received a vulnerability report regarding an HTTP request smuggling vulnerability in HTTP::Server. The issue was caused by the HTTP request parser prioritizing the Content-Length header over the Transfer-Encoding header, which can lead to desynchronization when a proxy that prioritizes the Transfer-Encoding header sits in front of HTTP::Server for example. The vulnerability was patched in Crystal 1.20.0 and Crystal 1.19.2, following the mitigation from RFC 9112, Section 6.1 to always reject requests with both headers and to prioritize Transfer-Encoding then close the…

Read at the source

Official Linux ARM64 builds (opens on the source site)

This has been a long awaited feature: how to run Crystal on ARM64 CPUs? Crystal has supported ARM64 as a tier 1 architecture for many years now, and we already distribute an universal build for macOS, but still no ARM64 builds for Linux. The wait is over! During the development of Crystal 1.19 we bootstrapped a 1.18.2 compiler for ARM64 that was then used to bootstrap official builds for nightlies and the 1.19 release. The builds are available everywhere we provide an AMD64 build of the compiler for Linux: nightly builds, release tarballs, Docker images, Snap, as well as the install-crystal…

Read at the source

Crystal talk at FOSDEM 2026 (opens on the source site)

I’m giving a talk about Crystal at FOSDEM 2026 in Brussels: Crystal: A language for humans and computers. It’s in the Declarative and Minimalistic Computing track, on Sunday, 1 February 2026 at 09:00 in room UB4.136.

Read at the source

Privacy choices

Reading never requires analytics. These choices last 90 days on this browser.

Essential sign-in and security storage always stays on. Read the privacy notice.