Description
In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.
Affected products
excon_project: excon; opensuse: backports sle; opensuse: leap; debian: debian linux
References10
- github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9 Vendor Advisory
- github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9 Vendor Advisory
- github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab… Patch
- github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab… Patch
- lists.opensuse.org/opensuse-security-announce/2020-01/msg00021.… Third Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-01/msg00062.… Third Party Advisory
- lists.debian.org/debian-lts-announce/2020/01/msg00015.html Mailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-01/msg00021.… Third Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-01/msg00062.… Third Party Advisory
- lists.debian.org/debian-lts-announce/2020/01/msg00015.html Mailing ListThird Party Advisory
Metrics
- CVSS 3.1
-
5.9
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS — exploit probability
- 2% percentile: 77 · as of 10 November 2026
- CWE
- CWE-664CWE-362
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.