CVE-2026-54171

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/excon/excon/commit/ea89a35308a12f4b791b6c50f2cbd33f94889fa3	Patch
https://github.com/excon/excon/pull/901	Issue Tracking Patch
https://github.com/excon/excon/security/advisories/GHSA-48rx-c7pg-q66r	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:excon_project:excon:*:*:*:*:*:ruby:*:*

History

29 Jul 2026, 15:20

Type	Values Removed	Values Added
CPE		cpe:2.3:a:excon_project:excon::::::ruby::*
First Time		Excon Project excon Excon Project
References	~~() https://github.com/excon/excon/commit/ea89a35308a12f4b791b6c50f2cbd33f94889fa3 -~~	() https://github.com/excon/excon/commit/ea89a35308a12f4b791b6c50f2cbd33f94889fa3 - Patch
References	~~() https://github.com/excon/excon/pull/901 -~~	() https://github.com/excon/excon/pull/901 - Issue Tracking, Patch
References	~~() https://github.com/excon/excon/security/advisories/GHSA-48rx-c7pg-q66r -~~	() https://github.com/excon/excon/security/advisories/GHSA-48rx-c7pg-q66r - Patch, Vendor Advisory

17 Jul 2026, 20:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-17 20:17

Updated : 2026-07-29 15:20

NVD link : CVE-2026-54171

Mitre link : CVE-2026-54171

CVE.ORG link : CVE-2026-54171

JSON object : View

Products Affected

excon_project

excon

CWE

CWE-201

Insertion of Sensitive Information Into Sent Data

{"id": "CVE-2026-54171", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54171", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T13:59:31.856340Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "excon", "product": "excon", "versions": [{"status": "affected", "version": "< 1.5.0"}]}]}], "published": "2026-07-17T20:17:26.500", "references": [{"url": "https://github.com/excon/excon/commit/ea89a35308a12f4b791b6c50f2cbd33f94889fa3", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/excon/excon/pull/901", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/excon/excon/security/advisories/GHSA-48rx-c7pg-q66r", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-201"}]}], "descriptions": [{"lang": "en", "value": "Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0."}], "lastModified": "2026-07-29T15:20:21.357", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:excon_project:excon:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "8D5B564D-C8A8-490B-8B2D-C5932C20A45F", "versionEndExcluding": "1.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}