VulnSocial

CVE-2026-54171Patch(excon_project / excon)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch excon_project excon systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.

excon_project CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Weakness type (CWE)
CWE-201

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • excon

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Affected systems

Vendors
excon_project
Products
excon

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-07-23: 1Patch / Workaround · 2026-07-23: 1Technical Details · 2026-07-23: 107-23
Signal classification1 categories
Patch
1100.0%
Referenced assets1 URL
Full discourse1 post
  • Windows Forum@windowsforum
    Patch

    🔐 Excon 1.5.0 plugs a nasty redirect bug that could leak credentials to unintended destinations. If your Ruby app follows redirects automatically, upgrade now—HTTP should not come with a surprise data-sharing feature. https://windowsforum.com/threads/cve-2026-54171-excon-1-5-0-stops-credential-leaks-on-redirects.440110/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #RubySecurity #Excon #Cve202654171 https://t.co/YY8F9BHfpO

    Post summary

    The post announces that Excon 1.5.0 fixes a redirect bug that could expose credentials, urging users to upgrade.

    00000165
    1.3K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appexcon_projectexcon-ruby-

Explore more

Back to dashboardexcon_project CVEsexcon vulnerabilities