In RubyGem excon, interrupted Persistent Connections May Leak Response Data
Summary
| CVE | CVE-2019-16779 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-12-16 20:15:15 UTC |
| Updated | 2026-07-28 18:16:09 UTC |
| Description | In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this. |
Risk And Classification
Primary CVSS: v3.1 5.9 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.014390000 probability, percentile 0.704740000 (date 2026-07-29)
Problem Types: CWE-664 | CWE-362 | CWE-664 CWE-664 Improper Control of a Resource Through its Lifetime
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | [email protected] | Secondary | 5.8 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N |
| 3.1 | CNA | DECLARED | 5.8 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N |
| 2.0 | [email protected] | Primary | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:M/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Application | Excon Project | Excon | All | All | All | All |
| Application | Opensuse | Backports Sle | 15.0 | sp1 | All | All |
| Operating System | Opensuse | Leap | 15.1 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Interrupted Persistent Connections May Leak Response Data · Advisory · excon/excon · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Vendor Advisory |
| [security-announce] openSUSE-SU-2020:0139-1: moderate: Security update f | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | Third Party Advisory |
| [security-announce] openSUSE-SU-2020:0036-1: moderate: Security update f | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | Third Party Advisory |
| [SECURITY] [DLA 2070-1] ruby-excon security update | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | Mailing List, Third Party Advisory |
| fix for leftover data with interrupted persistent connections · excon/excon@ccb57d7 · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Workarounds
CNA: Users can workaround the problem by disabling persistent connections, though this may cause performance implications.
There are currently no legacy QID mappings associated with this CVE.