Excon does not redact additional sensitive/risky headers when following redirects
GHSA-48rx-c7pg-q66r · CVE-2026-54171
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
The redirect follower middleware previously failed to strip a number of headers that are known to be sensitive and did not provide a way to provide a custom list of headers to strip.
What kind of vulnerability is it? Who is impacted?
This could cause inadvertent leakage of sensitive data for users of the RedirectFollower middleware in cases where the initial request includes header information that is not intended for the new target.
Patches
Patch exists and is released in v1.5.0
Workarounds
Users can backport the fix to a custom redirect follower middleware.
References
- WEB https://github.com/excon/excon/security/advisories/GHSA-48rx-c7pg-q66r
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-54171
- WEB https://github.com/excon/excon/pull/901
- WEB https://github.com/excon/excon/commit/ea89a35308a12f4b791b6c50f2cbd33f94889fa3
- PACKAGE https://github.com/excon/excon
- WEB https://github.com/rubysec/ruby-advisory-db/blob/master/gems/excon/CVE-2026-54171.yml
- WEB https://www.cve.org/CVERecord?id=CVE-2026-54171
Ready to move
Start Securing
Free, no credit card | First findings in minutes