CVE-2019-16779
MediumCVSS 5.8Exploitation Probability (EPSS)
Elevated risk70th percentile - higher than 70% of all known CVEs
Summary
In RubyGem excon before version 0.71.0, a race condition exists around persistent connections. An interrupted connection (e.g., due to a timeout) leaves data on the socket, which is read by subsequent requests, returning content from the previous response. The race condition window is narrow, making intentional exploitation difficult.
Risk Assessment
The organization is at risk of data leakage between HTTP requests, potentially leading to disclosure of sensitive information or response integrity violations.
Recommendation
Update the excon library to version 0.71.0 or later.
Original NVD description (English source)
In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.