Skip to content
Fencer Vulns
medium 5.8

CVE-2019-16779 json

In RubyGem excon, interrupted Persistent Connections May Leak Response Data

published 2019-12-16 6 y ago modified 2026-09-10 1 mo ago also GHSA-q58g-455p-8vw9 , EUVD-2019-0799

cvss
5.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.7%
EPSS 1.7% chance of exploitation in 30 days, percentile 76%
public exploits
0
none known

Summary

In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.

Patch / fix

  • rubygems excon 0.71.0
  • excon excon 0.71.0
  • ruby-excon Debian 14, Debian 13, Debian 12 0.60.0-2

debian advisories DEBIAN-CVE-2019-16779

  • rubygem-excon SLE Module for Containers 12 0.52.0-12.3.8

suse advisories SUSE-SU-2020:2053-1

  • rubygem-excon Package Hub 15 SP1 0.59.0-bp151.4.3.1
  • rubygem-excon openSUSE Leap 15.1 0.59.0-lp151.3.3.1

opensuse advisories openSUSE-SU-2020:0139-1openSUSE-SU-2020:0036-1

Exploit prediction

1.66% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
NVD 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N
GitHub 3.1 5.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
rubygems excon
<0.71.0
0.71.0

Affected products

  • excon excon

Classification

Weakness
  • CWE-664 Improper Control of a Resource Through its Lifetime
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.