CVE-2026-54171: Excon: redact additional sensitive/risky headers when following redirects
Impact The redirect follower middleware previously failed to strip a number of headers that are known to be sensitive and did not provide a way to provide a custom list of headers to strip.
What kind of vulnerability is it? Who is impacted? This could cause inadvertent leakage of sensitive data for users of the RedirectFollower middleware in cases where the initial request includes header information that is not intended for the new target.
Patches Patch exists and is released in v1.5.0
Workarounds Users can backport the fix to a custom redirect follower middleware.
Other sources
Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.
— MITRE
Excon: redact additional sensitive/risky headers when following redirects
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/exconto a version that resolves this vulnerability.Fixed in 1.5.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.102.0-2 - Upgrade
Upgrade
exconto a version that resolves this vulnerability.Fixed in 1.5.0Patch ea89a35308a12f4b791b6c50f2cbd33f94889fa3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54171?
CVE-2026-54171 has a medium severity rating of 6.5.
What impact does CVE-2026-54171 have on users?
CVE-2026-54171 can cause inadvertent leakage of sensitive data due to improper handling of headers.
Which software is affected by CVE-2026-54171?
CVE-2026-54171 affects the Ruby gem Excon.
How do I fix CVE-2026-54171?
To fix CVE-2026-54171, update to the latest version of the Excon gem that addresses this vulnerability.
Who is impacted by CVE-2026-54171?
Developers using Excon for HTTP requests may be impacted by CVE-2026-54171 due to the risk of leaking sensitive information.