The vulnerability in Excon's RedirectFollower middleware involves failure to strip multiple sensitive headers during HTTP redirect handling. Without redaction, headers containing sensitive data may be forwarded to new targets unintentionally, potentially exposing confidential information. The middleware also lacked the capability to customize which headers to strip. This issue affects versions prior to 1.5.0. A fix was introduced in version 1.5.0 to properly redact these headers and allow customization.

Sensitive header information may be leaked to unintended redirect targets when using the vulnerable RedirectFollower middleware. This exposure could compromise confidentiality of sensitive data included in headers. There is no indication of impact on integrity or availability.

Upgrade to Excon version 1.5.0 or later, where the issue is fixed with proper redaction of sensitive headers during redirects. Alternatively, users can backport the fix from the official patch commit to their own custom redirect follower middleware implementations. No other mitigation is indicated.