PT-2026-57352 · Rubygems · Excon

Publicado 2026-07-10 · Atualizado 2026-07-10

OSV

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Impact

The redirect follower middleware previously failed to strip a number of headers that are known to be sensitive and did not provide a way to provide a custom list of headers to strip.

What kind of vulnerability is it? Who is impacted? This could cause inadvertent leakage of sensitive data for users of the RedirectFollower middleware in cases where the initial request includes header information that is not intended for the new target.

Patches

Patch exists and is released in v1.5.0

Workarounds

Users can backport the fix to a custom redirect follower middleware.

Exploit

Correção

Identificadores relacionados

GHSA-48RX-C7PG-Q66R

Produtos afetados

Excon

Referências · 6

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/excon/CVE-2026-54171.yml · Exploit
• https://github.com/excon/excon/security/advisories/GHSA-48rx-c7pg-q66r · Nota
• https://github.com/excon/excon · Nota
• https://github.com/excon/excon/commit/ea89a35308a12f4b791b6c50f2cbd33f94889fa3 · Nota
• https://cve.org/CVERecord?id=CVE-2026-54171 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-48rx-c7pg-q66r · Aviso do Fabricante