CVE-2026-54171

Published: Jul 17, 2026Modified: Jul 20, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.

Related CWEs

CWE-201

Insertion of Sensitive Information Into Sent Data

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

References (3)

https://github.com/excon/excon/commit/ea89a35308a12f4b791b6c50f2cbd33f94889fa3

Source: security-advisories@github.com

https://github.com/excon/excon/pull/901

Source: security-advisories@github.com

https://github.com/excon/excon/security/advisories/GHSA-48rx-c7pg-q66r

Source: security-advisories@github.com

Timeline

No history available yet.