GitHub Advisoryadvisory · RubyGems
GHSA-48rx-c7pg-q66r Excon does not redact additional sensitive/risky headers when following redirects
MEDIUM
Official page ↗
- Aliases
- CVE-2026-54171
- Ecosystem
- RubyGems
- Packages
- excon
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-200, CWE-201, CWE-522
- Reviewed
- 2026-07-10
Affected packages
• RubyGems excon: < 1.5.0 → fixed in 1.5.0
Description
Impact
The redirect follower middleware previously failed to strip a number of headers that are known to be sensitive and did not provide a way to provide a custom list of headers to strip.
_What kind of vulnerability is it? Who is impacted?_
This could cause inadvertent leakage of sensitive data for users of the RedirectFollower middleware in cases where the initial request includes header information that is not intended for the new target.
Patches
Patch exists and is released in v1.5.0
Workarounds
Users can backport the fix to a custom redirect follower middleware.
Related
Alias · CVE (1)
- CVE-2026-54171 Excon is usable, fast, simple HTTP 1.1 for Ruby. vulnerability
References
- https://github.com/excon/excon/security/advisories/GHSA-48rx-c7pg-q66r web
- https://nvd.nist.gov/vuln/detail/CVE-2026-54171 advisory
- https://github.com/excon/excon/pull/901 web
- https://github.com/excon/excon/commit/ea89a35308a12f4b791b6c50f2cbd33f94889fa3 web
- https://github.com/excon/excon package
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/excon/CVE-2026-54171.yml web
- https://www.cve.org/CVERecord?id=CVE-2026-54171 web