EUVD-2026-45312
GHSA-48rx-c7pg-q66r
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-reachable via outbound HTTP; no privileges required on the target; UI:R reflects the application must initiate the redirected request; C:H for full credential/token exposure; no integrity or availability impact.
Primary rating from Vendor (https://github.com/excon/excon).
CVSS VectorVendor: https://github.com/excon/excon
Lifecycle Timeline
1DescriptionCVE.org
Impact
The redirect follower middleware previously failed to strip a number of headers that are known to be sensitive and did not provide a way to provide a custom list of headers to strip.
_What kind of vulnerability is it? Who is impacted?_ This could cause inadvertent leakage of sensitive data for users of the RedirectFollower middleware in cases where the initial request includes header information that is not intended for the new target.
Patches
Patch exists and is released in v1.5.0
Workarounds
Users can backport the fix to a custom redirect follower middleware.
AnalysisAI
Sensitive HTTP header leakage in the excon Ruby gem's RedirectFollower middleware exposes credentials and tokens to unintended redirect destinations. Applications using the RedirectFollower middleware that include headers such as Authorization or API keys in outbound requests will inadvertently forward those headers to the redirect target - which may be attacker-controlled or a third-party service. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; however, the CVSS 3.1 score of 6.5 reflects high confidentiality impact, and a vendor-released patch is available in v1.5.0.
Technical ContextAI
excon (pkg:rubygems/excon) is a Ruby HTTP client library widely used in Ruby on Rails applications and cloud tooling such as the Fog gem. The RedirectFollower middleware component is responsible for automatically following HTTP 3xx redirect responses. The root cause is the middleware's failure to strip sensitive request headers before re-issuing the request to the redirect target URL. This is a well-known class of HTTP redirect vulnerability: when a redirect crosses to a different origin or endpoint, headers intended exclusively for the original server - such as Authorization, Cookie, or API tokens - must be stripped. No CWE is assigned in the advisory, but this maps most closely to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The fix commit (ea89a35) and advisory (GHSA-48rx-c7pg-q66r) confirm the vulnerability is within the middleware layer of the gem itself, not in application-level code.
RemediationAI
Upgrade the excon gem to v1.5.0 or later, which patches the RedirectFollower middleware to strip sensitive headers before forwarding redirect requests. The fix is confirmed in commit ea89a35308a12f4b791b6c50f2cbd33f94889fa3 at https://github.com/excon/excon/commit/ea89a35308a12f4b791b6c50f2cbd33f94889fa3. If an immediate gem upgrade is not feasible, users can backport the fix by implementing a custom redirect follower middleware that explicitly strips sensitive headers (such as Authorization, Cookie, and any application-specific tokens) before re-issuing the request - this approach requires careful maintenance as the list of sensitive headers must be kept current. An alternative workaround is to disable automatic redirect following in excon and handle redirects manually in application code, giving the application full control over which headers are forwarded to each destination. The security advisory is available at https://github.com/excon/excon/security/advisories/GHSA-48rx-c7pg-q66r.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today