In RubyGem excon, interrupted Persistent Connections May Leak Response Data (CVE-2019-16779)

In RubyGem excon, interrupted Persistent Connections May Leak Response Data (CVE-2019-16779) | HOL Guard CVE

Why this deserves its current priority

CVSS is 5.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps excon (rubygems). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
exconrubygems	>=0 <0.71.0	0.71.0

Recommended response

Check inventory. Check lockfiles and deployed manifests for excon.
Review the reported fix. Update excon to 0.71.0 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Dec 16, 2019
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Aug 7, 2026

Sources and claim methodology

Upstream source description

### Impact There was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this. ### Patches The problem has been patched in 0.71.0, users should upgrade to this or a newer version (if one exists). ### Workarounds Users can workaround the problem by disabling persistent connections, though this may cause performance implications. ### References See the [patch](https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29) for further details. ### For more information If you have any questions or comments about this advisory: * Open an issue in [excon/issues](https://github.com/excon/excon/issues) * Email us at [[email protected]](mailto:[email protected])

Quoted source text, attributed separately from HOL analysis.