Description
In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| excon | excon | < 0.71.0 – < 0.71.0 | 0.71.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-excon | 0.60.0-2 | — |
| Debian 13 | ruby-excon | 0.60.0-2 | — |
| Debian 12 | ruby-excon | 0.60.0-2 | — |
| Debian 8 | ruby-excon | 0.33.0-2+deb8u1 | DLA-2070-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | ruby-excon | No fix yet | — |
| Ubuntu 16.04 LTS | ruby-excon | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | rubygem-excon | 0.52.0-12.3.8 | SUSE-SU-2020:2053-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP1 | rubygem-excon | 0.59.0-bp151.4.3.1 | openSUSE-SU-2020:0139-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.1 | rubygem-excon | 0.59.0-lp151.3.3.1 | openSUSE-SU-2020:0036-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | excon | < 0.71.0 | 0.71.0 | GHSA-q58g-455p-8vw9 |
Advisories 4
- DLA-2070-1 ruby-excon - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2020:0139-1 Security update for rubygem-excon SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:2053-1 Security update for rubygem-excon SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0036-1 Security update for rubygem-excon SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9
- https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29
- openSUSE-SU-2020:0036 vendor-advisory
- [debian-lts-announce] 20200119 [SECURITY] [DLA 2070-1] ruby-excon security update mailing-list
- openSUSE-SU-2020:0139 vendor-advisory