4.3.11, backport 5.6.2

History.md

@@ -1,3 +1,8 @@
+## 4.3.11 / 2022-02-11
+
+* Security
+  * Always close the response body (GHSA-rmj8-8hhh-gv5h)
+
 ## 4.3.10 / 2021-10-12
 
 * Bugfixes

lib/puma/const.rb

@@ -100,7 +100,7 @@ module Puma
   # too taxing on performance.
   module Const
 
-    PUMA_VERSION = VERSION = "4.3.10".freeze
+    PUMA_VERSION = VERSION = "4.3.11".freeze
     CODE_NAME = "Mysterious Traveller".freeze
     PUMA_SERVER_STRING = ['puma', PUMA_VERSION, CODE_NAME].join(' ').freeze
 

lib/puma/server.rb

@@ -873,11 +873,14 @@ module Puma
         end
 
       ensure
-        uncork_socket client
+        begin
+          uncork_socket client
 
-        body.close
-        req.tempfile.unlink if req.tempfile
-        res_body.close if res_body.respond_to? :close
+          body.close
+          req.tempfile.unlink if req.tempfile
+        ensure
+          res_body.close if res_body.respond_to? :close
+        end
 
         after_reply.each { |o| o.call }
       end