CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
CVE details

CVE-2026-54171

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.

Score
6.5 medium
Published
2026-07-17
Links
NVD · cve.org

Matched ports (3)

PortPackageVersionStatusMaintainer
devel/rubygem-excon-gitlabrubygem-excon-gitlab1.3.2unaddressedmfechner@FreeBSD.org
devel/rubygem-excon0rubygem-excon00.112.0unaddressedsunpoet@FreeBSD.org
devel/rubygem-excon1-gitlabrubygem-excon1-gitlab1.2.9unaddressedmfechner@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>rubygem-excon-gitlab</name>
	<range><lt>1.5.0</lt></range>
      </package>
      <package>
	<name>rubygem-excon0</name>
	<range><lt>1.5.0</lt></range>
      </package>
      <package>
	<name>rubygem-excon1-gitlab</name>
	<range><lt>1.5.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0,
	Excon's RedirectFollower middleware failed to strip additional
	sensitive headers when following redirects and did not provide a
	custom list of headers to strip. This could cause inadvertent leakage
	of sensitive data when the initial request includes header information
	that is not intended for the new target. This issue is fixed in
	version 1.5.0.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-54171</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-54171</url>
    </references>
    <dates>
      <discovery>2026-07-17</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>