CVE-2026-25765
MediumCVSS 5.8Summary
Faraday's build_exclusive_url method uses Ruby's URI#merge to combine the base URL with a user-supplied path. Protocol-relative URLs (e.g., //evil.com/path) can override the base URL's host, allowing an attacker to redirect requests to an arbitrary host and enabling Server-Side Request Forgery (SSRF). This is fixed in 2.14.1.
Risk Assessment
Applications passing user-controlled input to Faraday request methods may be exploited for SSRF, allowing an attacker to access internal resources or bypass access controls. The risk affects server-side services using vulnerable Faraday versions.
Recommendation
Update Faraday to version 2.14.1 or later. Additionally, validate and normalize user-supplied URLs before passing them to the library.
Other vulnerabilities in Faraday
See all- CVE-2026-54297High
A vulnerability in the Faraday library allows a DoS attack by sending a specially crafted nested query string. The NestedParamsEncoder does not enforce a maximum nesting depth, leading to stack overflow and crash of the thread or worker process.
- CVE-2026-33637Unknown
Faraday is an HTTP client library abstraction layer. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object (rather than a String) to Faraday::Connection#build_exclusive_url. This bypasses the February 2026 fix for GHSA-33mh-2634-fwr2 and enables off-host request forgery: a request built from a fixed-base Faraday::Connection can be redirected to an attacker-controlled host, forwarding connection-scoped values such as Authorization headers and default query parameters. This issue has been fixed in version 2.14.3.
Original NVD description (English source)
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Prior to 2.14.1, Faraday's build_exclusive_url method (in lib/faraday/connection.rb) uses Ruby's URI#merge to combine the connection's base URL with a user-supplied path. Per RFC 3986, protocol-relative URLs (e.g. //evil.com/path) are treated as network-path references that override the base URL's host/authority component. This means that if any application passes user-controlled input to Faraday's get(), post(), build_url(), or other request methods, an attacker can supply a protocol-relative URL like //attacker.com/endpoint to redirect the request to an arbitrary host, enabling Server-Side Request Forgery (SSRF). This vulnerability is fixed in 2.14.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS