CVE-2026-54171CWE-201

Excon: redact additional sensitive/risky headers when following redirects

Medium · published July 17, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
35.9
In the wild
Unconfirmed
What it is

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00427 · 35.9th percentile
Weakness
CWE-201 · Insertion of Sensitive Information Into Sent Data
Published
2026-07-17T20:09Z
EPSS history
Timeline
  • 17 JUL 20:09Z
    Excon: redact additional sensitive/risky headers when following redirects
    cvelistv5