excon: Excon: Information disclosure via unstripped sensitive headers during redirects (CVE-2026-54171)

Overview

A flaw was found in Excon, a Ruby HTTP client library. The RedirectFollower middleware, responsible for handling redirects, failed to remove sensitive header information when a request was redirected to a new target. This oversight could lead to the unintended exposure of confidential data to an unauthorized destination, potentially compromising sensitive information.

Vendor advisories

• Red Hat VEX · Moderate · affected: Red Hat 3scale API Management Platform 2, Red Hat Satellite 6 · no fix planned: Red Hat 3scale API Management Platform 2, Red Hat Satellite 6 · updated 2026-09-07 · vex

excon: Excon: Information disclosure via unstripped sensitive headers during redirects — rated Moderate by Red Hat. Released 2026-07-17, updated 2026-09-07.

Affected:

• Red Hat 3scale API Management Platform 2
• Red Hat Satellite 6

No fix planned:

• Red Hat 3scale API Management Platform 2
• Red Hat Satellite 6

Remediation

Fix deferred

Workarounds / mitigations:

• Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Package advisory (CVE-2026-54171)

Affected packages:

• excon < 1.5.0

Patched in:

• excon 1.5.0

Source: https://github.com/advisories/GHSA-48rx-c7pg-q66r