{"id":"CVE-2026-54171","aliases":["AZL-92460","DEBIAN-CVE-2026-54171","EUVD-2026-45312","GHSA-48rx-c7pg-q66r","OESA-2026-3100","UBUNTU-CVE-2026-54171"],"status":"published","title":"Excon: redact additional sensitive/risky headers when following redirects","description":"Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00427,"percentile":0.37439,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-201","CWE-522"],"published":"2026-07-10T20:37:29Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"RubyGems","package":"excon","fixed_in":["1.5.0"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"rubygem-excon","fixed_in":["0.102.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-excon","fixed_in":["1.5.0-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"rubygem-excon","fixed_in":["0.62.0-4.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"rubygem-excon","fixed_in":["0.62.0-4.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"rubygem-excon","fixed_in":["0.104.0-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"rubygem-excon","fixed_in":["0.104.0-2.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"rubygem-excon","fixed_in":["0.104.0-2.oe2403sp4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"excon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rubygem-excon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.102.0-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-excon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.112.0-1","0.112.0-2","0.112.0-3","0.112.0-4","0.88.0-1","1.3.1-1","1.3.2-1","1.3.2-2","1.4.0-1","1.4.0-2","1.4.2-1","1.5.0-1","1.6.0-1","1.7.0-1","1.7.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-excon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.112.0-4","1.3.1-1","1.3.2-1","1.3.2-2","1.4.0-1","1.4.0-2","1.4.2-1","1.5.0-1","1.6.0-1","1.7.0-1","1.7.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-excon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-1"}]}],"versions":["0.112.0-4","1.3.1-1","1.3.2-1","1.3.2-2","1.4.0-1","1.4.0-2","1.4.2-1"]},{"source":"osv","ecosystem":"RubyGems","package":"excon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.2","0.0.20","0.0.21","0.0.22","0.0.23","0.0.24","0.0.25","0.0.26","0.0.3","0.0.4","0.0.5","0.0.7","0.0.8","0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.10.0","0.10.1","0.100.0","0.101.0","0.102.0","0.103.0","0.104.0","0.105.0","0.106.0","0.107.0","0.108.0","0.109.0","0.11.0","0.110.0","0.111.0","0.112.0","0.12.0","0.13.0","0.13.1","0.13.2","0.13.3","0.13.4","0.14.0","0.14.1","0.14.2","0.14.3","0.15.0","0.15.1","0.15.2","0.15.3","0.15.4","0.15.5","0.16.0","0.16.1","0.16.10","0.16.2","0.16.3","0.16.4","0.16.5","0.16.7","0.16.8","0.16.9","0.17.0","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.18.5","0.19.0","0.19.1","0.19.2","0.19.3","0.19.4","0.19.5","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.2.6","0.2.7","0.2.8","0.20.0","0.20.1","0.21.0","0.22.0","0.22.1","0.23.0","0.24.0","0.25.0","0.25.1","0.25.2","0.25.3","0.26.0","0.27.0","0.27.1","0.27.2","0.27.3","0.27.4","0.27.5","0.27.6","0.28.0","0.29.0","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.3.8","0.30.0","0.31.0","0.32.0","0.32.1","0.33.0","0.34.0","0.35.0","0.36.0","0.37.0","0.38.0","0.39.0","0.39.1","0.39.2","0.39.3","0.39.4","0.39.5","0.39.6","0.4.0","0.40.0","0.41.0","0.42.0","0.42.1","0.43.0","0.44.0","0.44.1","0.44.2","0.44.3","0.44.4","0.45.0","0.45.1","0.45.2","0.45.3","0.45.4","0.46.0","0.47.0","0.48.0","0.49.0","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.5.7","0.5.8","0.50.0","0.50.1","0.51.0","0.52.0","0.53.0","0.54.0","0.55.0","0.56.0","0.57.0","0.57.1","0.58.0","0.59.0","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.6.6","0.60.0","0.61.0","0.62.0","0.63.0","0.64.0","0.65.0","0.66.0","0.67.0","0.68.0","0.69.0","0.69.1","0.7.0","0.7.1","0.7.10","0.7.11","0.7.12","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","0.7.8","0.7.9","0.70.0","0.71.0","0.71.1","0.72.0","0.73.0","0.74.0","0.75.0","0.76.0","0.78.0","0.78.1","0.79.0","0.8.0","0.80.0","0.80.1","0.81.0","0.82.0","0.83.0","0.84.0","0.85.0","0.86.0","0.87.0","0.88.0","0.89.0","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.90.0","0.91.0","0.92.0","0.92.1","0.92.2","0.92.3","0.92.4","0.92.5","0.93.0","0.93.1","0.94.0","0.95.0","0.96.0","0.97.0","0.97.1","0.97.2","0.98.0","0.99.0","1.0.0","1.1.0","1.1.1","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","1.3.0","1.3.1","1.3.2","1.4.0","1.4.1","1.4.2"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"rubygem-excon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-4.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"rubygem-excon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.62.0-4.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"rubygem-excon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.104.0-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"rubygem-excon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.104.0-2.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"rubygem-excon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.104.0-2.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ruby-excon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.45.1-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ruby-excon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.54.0-1","0.60.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ruby-excon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.60.0-1","0.60.0-2","0.72.0-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby-excon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.79.0-2","0.88.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby-excon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.88.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ruby-excon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-1","1.4.2-1","1.5.0-1","1.6.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ruby-excon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.112.0-4","1.3.1-1","1.3.2-1"]}],"products":[{"vendor":"excon","product":"excon"},{"vendor":"excon_project","product":"excon"}],"references":[{"url":"https://github.com/excon/excon/security/advisories/GHSA-48rx-c7pg-q66r","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/excon/excon/pull/901","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web","report"]},{"url":"https://github.com/excon/excon/commit/ea89a35308a12f4b791b6c50f2cbd33f94889fa3","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/excon/CVE-2026-54171.yml","tags":["web"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54171","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54171","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-48rx-c7pg-q66r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54171.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-54171","tags":["advisory"]},{"url":"https://github.com/excon/excon","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3100","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-54171","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-54171","title":"Excon: redact additional sensitive/risky headers when following redirects","description":"Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.","status":"published","published":"2026-07-17T20:09:44.716Z","modified":"2026-07-20T13:59:42.883Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-201"],"updated_at":"2026-11-02T13:38:09.774038Z"}],"euvd":[{"id":"EUVD-2026-45312","description":"Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.","status":"published","published":"2026-07-17T20:09:44Z","modified":"2026-07-20T13:59:42Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:19:49.035342Z"}],"ghsa":[{"id":"GHSA-48rx-c7pg-q66r","title":"Excon does not redact additional sensitive/risky headers when following redirects","description":"### Impact\nThe redirect follower middleware previously failed to strip a number of headers that are known to be sensitive and did not provide a way to provide a custom list of headers to strip. \n\n_What kind of vulnerability is it? Who is impacted?_\nThis could cause inadvertent leakage of sensitive data for users of the RedirectFollower middleware in cases where the initial request includes header information that is not intended for the new target.\n\n### Patches\nPatch exists and is released in v1.5.0\n\n### Workarounds\nUsers can backport the [fix](https://github.com/excon/excon/commit/ea89a35308a12f4b791b6c50f2cbd33f94889fa3) to a custom redirect follower middleware.","status":"published","published":"2026-07-10T20:37:29Z","modified":"2026-07-21T18:11:29Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-201","CWE-522"],"updated_at":"2026-11-02T14:40:50.444681Z"}],"nvd":[{"id":"CVE-2026-54171","description":"Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.","status":"published","published":"2026-07-17T20:17:26.5Z","modified":"2026-07-29T15:20:21.357Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-201"],"updated_at":"2026-11-02T14:12:30.250437Z"}],"osv":[{"id":"CVE-2026-54171","title":"Excon: redact additional sensitive/risky headers when following redirects","description":"Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.","status":"published","published":"2026-07-17T20:09:44.716Z","modified":"2026-10-28T02:31:05.567251628Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-201"],"updated_at":"2026-11-02T15:45:08.132336Z"},{"id":"DEBIAN-CVE-2026-54171","description":"Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.","status":"published","published":"2026-07-17T20:17:26.5Z","modified":"2026-10-01T03:03:26.709543487Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"GHSA-48rx-c7pg-q66r","title":"Excon does not redact additional sensitive/risky headers when following redirects","description":"### Impact\nThe redirect follower middleware previously failed to strip a number of headers that are known to be sensitive and did not provide a way to provide a custom list of headers to strip. \n\n_What kind of vulnerability is it? Who is impacted?_\nThis could cause inadvertent leakage of sensitive data for users of the RedirectFollower middleware in cases where the initial request includes header information that is not intended for the new target.\n\n### Patches\nPatch exists and is released in v1.5.0\n\n### Workarounds\nUsers can backport the [fix](https://github.com/excon/excon/commit/ea89a35308a12f4b791b6c50f2cbd33f94889fa3) to a custom redirect follower middleware.","status":"published","published":"2026-07-10T20:37:29Z","modified":"2026-09-10T03:50:51.41073914Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-201","CWE-522"],"updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"OESA-2026-3100","title":"rubygem-excon security update","description":"EXtended http(s) CONnections.\r\n\r\nSecurity Fix(es):\n\nExcon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon\u0026apos;s RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.(CVE-2026-54171)","status":"published","published":"2026-07-24T11:11:59Z","modified":"2026-08-18T01:21:21.367278011Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"UBUNTU-CVE-2026-54171","description":"Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.","status":"published","published":"2026-07-17T20:17:00Z","modified":"2026-10-17T12:59:02.878718779Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"AZL-92460","title":"CVE-2026-54171 affecting package rubygem-excon for versions less than 0.102.0-2","description":"Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.","status":"published","published":"2026-07-17T20:17:26Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.880689Z"}]}}