Vulnerability Description
Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Excon Project | Excon | < 1.5.0 |
Related Weaknesses (CWE)
References
- https://github.com/excon/excon/commit/ea89a35308a12f4b791b6c50f2cbd33f94889fa3Patch
- https://github.com/excon/excon/pull/901Issue TrackingPatch
- https://github.com/excon/excon/security/advisories/GHSA-48rx-c7pg-q66rPatchVendor Advisory
FAQ
What is CVE-2026-54171?
CVE-2026-54171 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom ...
How severe is CVE-2026-54171?
CVE-2026-54171 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-54171?
Check the references section above for vendor advisories and patch information. Affected products include: Excon Project Excon.