PT-2026-57370 · Rubygems · Excon

CVE-2026-54171 · Published 2026-07-10 · Updated 2026-07-17

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Excon versions prior to 1.5.0

Description The RedirectFollower middleware fails to strip sensitive headers when following redirects and lacks a mechanism to define a custom list of headers to be removed. This behavior can lead to the inadvertent leakage of sensitive data if the initial request contains header information not intended for the redirect target.

Recommendations Update to version 1.5.0. As a temporary workaround, backport the fix to a custom redirect follower middleware.

Exploit

Fix

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2026-54171

GHSA-48RX-C7PG-Q66R

Affected Products

Excon

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54171.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/excon/CVE-2026-54171.yml · Exploit
• https://osv.dev/vulnerability/GHSA-48rx-c7pg-q66r · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-54171 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-54171 · Security Note
• https://osv.dev/vulnerability/CVE-2026-54171 · Vendor Advisory
• https://github.com/excon/excon/pull/901 · Note
• https://github.com/excon/excon/security/advisories/GHSA-48rx-c7pg-q66r · Note
• https://github.com/excon/excon/commit/ea89a35308a12f4b791b6c50f2cbd33f94889fa3 · Note
• https://github.com/excon/excon · Note