---
id: CVE-2019-16779
title: >-
  In RubyGem excon before 0.71.0, there was a race condition around persistent
  connections, where a connection which is interrupted (such as by a timeout)
  would leave data on the socket
summary: >-
  In RubyGem excon before 0.71.0, there was a race condition around persistent
  connections, where a connection which is interrupted (such as by a timeout)
  would leave data on the socket. Subsequent requests would then read this data,
  retur…
severity: medium
cvss: 5.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N'
cwe:
  - CWE-664
  - CWE-362
vendor: excon_project
product: excon
affected:
  - excon < 0.71.0
  - backports_sle = 15.0
  - leap = 15.1
  - debian_linux = 8.0
patched:
  - excon 0.71.0
published: '2019-12-16'
updated: '2026-07-28'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-16779'
references:
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00021.html'
    label: security-advisories@github.com
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00062.html'
    label: security-advisories@github.com
  - url: >-
      https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29
    label: security-advisories@github.com
  - url: 'https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9'
    label: security-advisories@github.com
  - url: 'https://lists.debian.org/debian-lts-announce/2020/01/msg00015.html'
    label: security-advisories@github.com
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00021.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00062.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2020/01/msg00015.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.01439
epssPercentile: 0.72012
ingestedAt: '2026-07-28T18:38:07.814Z'
---

## Overview

In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.

## Affected

- `excon < 0.71.0`
- `backports_sle = 15.0`
- `leap = 15.1`
- `debian_linux = 8.0`

## Remediation

Upgrade past the affected range:

- `excon 0.71.0`