CVE-2026-54171: excon_project excon
CVSS: 6.5v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2026-54171DEBIAN-CVE-2026-54171CGA-796p-45vv-rfqqCGA-c95r-cr3m-5365CGA-mh3p-v4pr-f5v4CGA-rr2f-2ccp-ww7cCGA-vrv8-v8v7-8v67CGA-wc7v-4c9c-5q6mCGA-x5rr-8c82-gwv3CGA-277h-xxg3-6vq8CGA-2fvf-9pwj-82wfCGA-2m7v-4f3r-vx3cCGA-2xj4-93q9-mg6fCGA-32p6-mwv2-p6jpCGA-3w4f-f9c3-qv46CGA-4hvc-rc4h-gj2rCGA-4pxf-9mvv-gvvmCGA-4xrf-v5gv-mgpwCGA-53fc-fmc8-hw36CGA-5jpx-6f7w-5hvjCGA-5mfw-76r4-566xCGA-5v7v-fc22-5cfhCGA-69x9-8hp9-cg8xCGA-6hhx-3fqc-94cfCGA-6xcr-27g7-8w3pCGA-73v4-2wp6-xwp7CGA-7vjc-gfm8-h34jCGA-856m-mvrm-985hCGA-89x4-394g-mmh9CGA-8cm7-qmf7-63crCGA-8x9r-mqh9-v2wxCGA-9pjp-vjqg-wvjwCGA-c64j-vm7p-xmp2CGA-cjrr-f2x2-43m7CGA-cm78-3h6g-6979CGA-cmgm-9cxm-gc3wCGA-f3v6-x98m-8c29CGA-f563-r3pq-269wCGA-f6px-5c8r-hhv6CGA-gqfh-p3hf-rgfpCGA-grj6-9mrp-wc43CGA-grvq-89h8-hmpjCGA-h44m-245x-q74xCGA-h88g-4mp8-3fg3CGA-m38c-67ww-vvwjCGA-mph9-c8x4-vh7vCGA-p37c-m6cm-ggr5CGA-p77j-mcx8-228qCGA-pq55-qj92-cvx2GHSA-48rx-c7pg-q66rCGA-q5rr-83vj-xj2cCGA-q6hx-p7r7-r252CGA-qfxr-gw3v-82xqCGA-qgv2-74xv-f8wrCGA-qm82-gq2w-829cCGA-qrmg-9cg5-x4vhCGA-r2gj-5vmp-9mrmCGA-r7p4-6cp5-xpg7CGA-r95f-r4m4-px93CGA-rv4q-3w9x-r8v3CGA-rvxf-3j2j-xx6fCGA-v3q2-gphf-ccw5CGA-vj77-63hr-869hCGA-wj9h-r89r-jfcrCGA-xfxx-wrg3-rm5xCGA-xq8p-65vq-pcvq
Published 17-07-2026Last modified 20-07-2026
Vulnerability summary
CVE-2026-54171 is a medium (CVSS 6.5) vulnerability in excon_project excon. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.6% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)EPSS score
0.43%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 17-07-2026PublishedVulnerability first disclosed.
- 20-07-2026Last modifiedVulnerability information updated.
Description
Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.
CVSS metrics
7 scores · 7 sources · 1 versionMedium 6.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · RubygemsEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
0.00 pp
From 0.43% on 20-09-2026
20-09-202620-10-2026
EPSS score0.43%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard31 products
- cinc-auditor< 7.1.7-r6 | < 7.1.7-r7
- commercial-gitlab-rails-ee-19.1All versions (No fix recorded)
- commercial-gitlab-rails-ee-19.2< 19.2.7-r4
- commercial-gitlab-rails-ee-fips-19.1All versions (No fix recorded)
- commercial-gitlab-rails-ee-fips-19.2< 19.2.7-r4
Wolfi3 products
- cinc-auditor< 7.1.7-r6 | < 7.1.7-r7
- ruby3.2-kube-logging-operator-fluentd-outputs< 6.7.0-r8
- ruby3.4-kube-logging-operator-fluentd-outputs< 6.7.0-r8
Debian1 product
- ruby-exconAll versions (No fix recorded) | < 1.5.0-1
Excon1 product
- excon< 1.5.0
Excon_project1 product
- excon< 1.5.0
RubyGems1 product
- excon< 1.5.0
Ubuntu1 product
- ruby-exconAll versions (No fix recorded)
7 vendors · 39 products
References
10 links- github.com/excon/excon/security/advisories/GHSA-48rx-c7pg-q66rX Refsource CONFIRMREPORTAdvisoryWEBPatchVendor Advisory
- github.com/excon/exconPACKAGE