CVE-2026-54171

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54171
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-54171.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-54171
Aliases
Downstream
Published
2026-07-17T20:09:44.716Z
Modified
2026-07-25T03:32:05.861008496Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Excon: redact additional sensitive/risky headers when following redirects
Details

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.

Database specific 
{
    "cwe_ids": [
        "CWE-201"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54171.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/excon/excon

Affected ranges

Type
GIT
Repo
https://github.com/excon/excon
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ea89a35308a12f4b791b6c50f2cbd33f94889fa3
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.5.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.0.22
v0.0.23
v0.0.24
v0.0.25
v0.0.26
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v0.10.0
v0.10.1
v0.100.0
v0.101.0
v0.102.0
v0.103.0
v0.104.0
v0.105.0
v0.106.0
v0.107.0
v0.108.0
v0.109.0
v0.11.0
v0.110.0
v0.111.0
v0.112.0
v0.12.0
v0.13.0
v0.13.1
v0.13.2
v0.13.3
v0.13.4
v0.14.0
v0.14.1
v0.14.2
v0.14.3
v0.15.0
v0.15.1
v0.15.2
v0.15.3
v0.15.4
v0.15.5
v0.16.0
v0.16.1
v0.16.10
v0.16.2
v0.16.3
v0.16.4
v0.16.5
v0.16.6
v0.16.7
v0.16.8
v0.16.9
v0.17.0
v0.18.0
v0.18.1
v0.18.2
v0.18.3
v0.18.4
v0.18.5
v0.19.0
v0.19.1
v0.19.2
v0.19.3
v0.19.4
v0.19.5
v0.2.0
v0.2.1
v0.2.2
v0.2.3
v0.2.4
v0.2.5
v0.2.6
v0.2.7
v0.2.8
v0.20.0
v0.20.1
v0.21.0
v0.22.0
v0.22.1
v0.23.0
v0.24.0
v0.25.0
v0.25.1
v0.25.2
v0.25.3
v0.26.0
v0.27.0
v0.27.1
v0.27.2
v0.27.3
v0.27.4
v0.27.5
v0.27.6
v0.28.0
v0.29.0
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.3.4
v0.3.5
v0.3.6
v0.3.7
v0.3.8
v0.30.0
v0.31.0
v0.32.0
v0.32.1
v0.33.0
v0.34.0
v0.35.0
v0.36.0
v0.37.0
v0.38.0
v0.39.0
v0.39.1
v0.39.2
v0.39.3
v0.39.4
v0.39.5
v0.39.6
v0.4.0
v0.40.0
v0.41.0
v0.42.0
v0.42.1
v0.43.0
v0.44.0
v0.44.1
v0.44.2
v0.44.3
v0.44.4
v0.45.0
v0.45.1
v0.45.2
v0.45.3
v0.45.4
v0.46.0
v0.47.0
v0.48.0
v0.49.0
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.5.4
v0.5.5
v0.5.6
v0.5.7
v0.5.8
v0.50.0
v0.50.1
v0.52.0
v0.53.0
v0.54.0
v0.55.0
v0.56.0
v0.57.0
v0.57.1
v0.58.0
v0.59.0
v0.6.0
v0.6.1
v0.6.2
v0.6.3
v0.6.4
v0.6.5
v0.6.6
v0.60.0
v0.61.0
v0.62.0
v0.63.0
v0.64.0
v0.65.0
v0.66.0
v0.67.0
v0.68.0
v0.69.0
v0.69.1
v0.7.0
v0.7.1
v0.7.10
v0.7.11
v0.7.12
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.7.6
v0.7.7
v0.7.8
v0.7.9
v0.70.0
v0.71.0
v0.71.1
v0.72.0
v0.73.0
v0.74.0
v0.75.0
v0.76.0
v0.77.0
v0.78.0
v0.78.1
v0.79.0
v0.8.0
v0.80.0
v0.80.1
v0.81.0
v0.82.0
v0.83.0
v0.84.0
v0.85.0
v0.86.0
v0.87.0
v0.88.0
v0.89.0
v0.9.0
v0.9.1
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v0.9.6
v0.90.0
v0.91.0
v0.92.0
v0.92.1
v0.92.2
v0.92.3
v0.92.4
v0.92.5
v0.93.0
v0.93.1
v0.94.0
v0.95.0
v0.96.0
v0.97.0
v0.97.1
v0.97.2
v0.98.0
v0.99.0
v1.*
v1.0.0
v1.1.0
v1.1.1
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.2.6
v1.2.7
v1.2.8
v1.2.9
v1.3.0
v1.3.1
v1.3.2
v1.4.0
v1.4.1
v1.4.2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-54171.json"