Answer in brief
CVE-2026-54171 records a Medium severity (CVSS 6.5) vulnerability in Excon does not redact additional sensitive/risky headers when following redirects. The current sources do not mark it as known exploited. The current feed maps excon (rubygems), excon (rubygems). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps excon (rubygems), excon (rubygems). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| exconrubygems | <1.5.0 | 1.5.0 |
| exconrubygems | >=0 <1.5.0 | 1.5.0 |
Published upstream
Jul 10, 2026
Evidence: source:osv:source_dates:source-dates:recordSource modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:recordFirst seen by HOL
Jul 10, 2026
### Impact The redirect follower middleware previously failed to strip a number of headers that are known to be sensitive and did not provide a way to provide a custom list of headers to strip. _What kind of vulnerability is it? Who is impacted?_ This could cause inadvertent leakage of sensitive data for users of the RedirectFollower middleware in cases where the initial request includes header information that is not intended for the new target. ### Patches Patch exists and is released in v1.5.0 ### Workarounds Users can backport the [fix](https://github.com/excon/excon/commit/ea89a35308a12f4b791b6c50f2cbd33f94889fa3) to a custom redirect follower middleware.
Quoted source text, attributed separately from HOL analysis.