CVE-2026-33637
UnknownCVSS 0.0Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Faraday is an HTTP client library abstraction layer. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object (rather than a String) to Faraday::Connection#build_exclusive_url. This bypasses the February 2026 fix for GHSA-33mh-2634-fwr2 and enables off-host request forgery: a request built from a fixed-base Faraday::Connection can be redirected to an attacker-controlled host, forwarding connection-scoped values such as Authorization headers and default query parameters. This issue has been fixed in version 2.14.3.
Risk Assessment
The risk is request redirection to an attacker-controlled host with forwarding of sensitive headers, potentially leading to data leakage or unauthorized access.
Recommendation
Immediately update Faraday library to version 2.14.3 or later, and check for any data leakage.
Other vulnerabilities in Faraday
See all- CVE-2026-25765Medium
Faraday's build_exclusive_url method uses Ruby's URI#merge to combine the base URL with a user-supplied path. Protocol-relative URLs (e.g., //evil.com/path) can override the base URL's host, allowing an attacker to redirect requests to an arbitrary host and enabling Server-Side Request Forgery (SSRF). This is fixed in 2.14.1.
- CVE-2026-54297High
A vulnerability in the Faraday library allows a DoS attack by sending a specially crafted nested query string. The NestedParamsEncoder does not enforce a maximum nesting depth, leading to stack overflow and crash of the thread or worker process.
Original NVD description (English source)
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object (rather than a String) to Faraday::Connection#build_exclusive_url. This bypasses the February 2026 fix for GHSA-33mh-2634-fwr2 and enables off-host request forgery: a request built from a fixed-base Faraday::Connection can be redirected to an attacker-controlled host, forwarding connection-scoped values such as Authorization headers and default query parameters. This issue has been fixed in version 2.14.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS