In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket.
CVSS 3.1MEDIUM 5.9·Network·No auth·No interaction·EPSS 0.01662·Published 2019-12-16·Fixed in 0.71.0CWE-664