CVE-2026-54171

Published: Jul 17, 2026Modified: Jul 29, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.

Affected (1)

Products: Excon Project: Excon

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Excon Project Excon	Before 1.5.0

Related CWEs

Insertion of Sensitive Information Into Sent Data

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

References (3)

https://github.com/excon/excon/commit/ea89a35308a12f4b791b6c50f2cbd33f94889fa3

Source: security-advisories@github.com

Patch

https://github.com/excon/excon/pull/901

Source: security-advisories@github.com

Issue TrackingPatch

https://github.com/excon/excon/security/advisories/GHSA-48rx-c7pg-q66r

Source: security-advisories@github.com

PatchVendor Advisory

Timeline

No history available yet.