CVE-2026-54171

MediumCVSS 6.5

Published: 17/07/2026(UTC)Updated: 29/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

24th percentile - higher than 24% of all known CVEs

Summary

Excon before version 1.5.0 has a vulnerability in the RedirectFollower middleware that fails to strip additional sensitive headers during redirects, potentially leading to data leakage.

Risk Assessment

Sensitive data in request headers may be exposed during a redirect to an untrusted server.

Recommendation

Update Excon to version 1.5.0 or later.

Other vulnerabilities in Excon

CVE-2019-16779Medium
In RubyGem excon before version 0.71.0, a race condition exists around persistent connections. An interrupted connection (e.g., due to a timeout) leaves data on the socket, which is read by subsequent requests, returning content from the previous response. The race condition window is narrow, making intentional exploitation difficult.

Original NVD description (English source)

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS