TI-2026-20832 Aliases CVE-2026-25765 GHSA-33mh-2634-fwr2

Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url

LOW 32CWE-918Published 2026-02-09 · Updated 2026-02-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-918 and the CVSS impact.

Summary

Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Prior to 2.14.1, Faraday's build_exclusive_url method (in lib/faraday/connection.rb) uses Ruby's URI#merge to combine the connection's base URL with a user-supplied path. Per RFC 3986, protocol-relative URLs (e.g. //evil.com/path) are treated as network-path references that override the base URL's host/authority component. This means that if any application passes user-controlled input to Faraday's get(), post(), build_url(), or other request methods, an attacker can supply a protocol-relative URL like //attacker.com/endpoint to redirect the request to an arbitrary host, enabling Server-Side Request Forgery (SSRF). This vulnerability is fixed in 2.14.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00393 33rd percentileScored 2026-11-07

Fix Partial faraday (lostisland): 2.14.1faraday (RubyGems): 2.14.1, 1.10.5Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
lostisland	faraday	before 2.14.1	2.14.1	Patch available	CNA
—	faraday (RubyGems)	2.0.0 to before 2.14.1	2.14.1	Patch available	GHSA-33mh-2634-fwr2
—	faraday (RubyGems)	1.0.0 to before 1.10.5	1.10.5	Patch available	GHSA-33mh-2634-fwr2

faraday Vendorlostisland Affected before 2.14.1 Fixed in 2.14.1 Patch available CNA
faraday (RubyGems) Vendor— Affected 2.0.0 to before 2.14.1 Fixed in 2.14.1 Patch available GHSA-33mh-2634-fwr2
faraday (RubyGems) Vendor— Affected 1.0.0 to before 1.10.5 Fixed in 1.10.5 Patch available GHSA-33mh-2634-fwr2

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:faraday_project:faraday::::::::	1.0.0 to before 1.10.5; 2.0.0 to before 2.14.1	Vulnerable	lostisland

cpe:2.3:a:faraday_project:faraday:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.10.5; 2.0.0 to before 2.14.1 Vulnerable ·lostisland

Remediation

Fix · CNA faraday (lostisland) Fixed in 2.14.1
Fix · GHSA-33mh-2634-fwr2 faraday (RubyGems) Fixed in 2.14.1 Advisory →
Fix · GHSA-33mh-2634-fwr2 faraday (RubyGems) Fixed in 1.10.5 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Logging Subsystem for Red Hat OpenShift	Affected	No fix yet: Fix deferred
Red Hat 3scale API Management Platform 2	Affected	No fix yet: Fix deferred
Red Hat OpenShift Container Platform 4	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-25765
2026-10-03 Alias added: GHSA-33mh-2634-fwr2

References

Patch 1

https://github.com/lostisland/faraday/commit/a6d3a3a0bf59c2ab307d0abd91bc126aef5561bc

Advisory 2

Other 7

TI-2026-39193 Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters CVSS 3.1HIGH 7.5
TI-2026-26018 Faraday: Protocol-relative URI objects still bypass host scoping (possible incomplete fix for GHSA-33mh-2634-fwr2) CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences