CVE-2026-54171

Name	CVE-2026-54171
Description	Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ruby-excon (PTS)	bullseye	0.79.0-2	vulnerable
	bookworm	0.88.0-1	vulnerable
	trixie	0.112.0-4	vulnerable
	forky, sid	1.5.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
ruby-excon	source	(unstable)	1.5.0-1

Notes

https://github.com/excon/excon/security/advisories/GHSA-48rx-c7pg-q66r
https://github.com/excon/excon/pull/901
Fixed by: https://github.com/excon/excon/commit/ea89a35308a12f4b791b6c50f2cbd33f94889fa3 (v1.5.0)