CVE-2019-16779
Low
No strong exploitation signal.
CVSS base
5.8
MEDIUM
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
EPSS — probability of exploitation (30 days)
1.4%
72.0th percentile
CISA KEV
Not listed
Weakness / dates
CWE-362
Published 2019-12-16 · modified 2026-07-28
CVSS breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
| Attack Vector | N | Network |
| Attack Complexity | H | High |
| Privileges Required | L | Low |
| User Interaction | R | Required |
| Scope | C | Changed |
| Confidentiality | H | High |
| Integrity | N | None |
| Availability | N | None |
Timeline
- 2019-12-16 — Published (NVD)
- 2026-07-28 — Last modified (NVD)
Description
In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.
Affected
References
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00062.html
- https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29
- https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9
- https://lists.debian.org/debian-lts-announce/2020/01/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00062.html
- https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29
- https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9
- https://lists.debian.org/debian-lts-announce/2020/01/msg00015.html