Log in Start free

Vulnerability · Published May 19, 2026 · Assigned by GitHub_M

CVE-2026-33637Faraday: Protocol-relative URI objects still bypass host scoping (possible incomplete fix for GHSA-33mh-2634-fwr2)

None 0.0

In plain English

A server-side request forgery in faraday from lostisland. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)0.0None
Exploit odds (30 days)0.3%top 80.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object (rather than a String) to Faraday::Connection#build_exclusive_url. This bypasses the February 2026 fix for GHSA-33mh-2634-fwr2 and enables off-host request forgery: a request built from a fixed-base Faraday::Connection can be redirected to an attacker-controlled host, forwarding connection-scoped values such as Authorization headers and default query parameters. This issue has been fixed in version 2.14.3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14ruby-faraday2.14.3-1DEBIAN-CVE-2026-33637
RubyGemsfaraday2.14.2GHSA-5rv5-xj5j-3484
Ubuntu:22.04:LTSruby-faradayno fix listedUBUNTU-CVE-2026-33637
Ubuntu:24.04:LTSruby-faradayno fix listedUBUNTU-CVE-2026-33637
Ubuntu:25.10ruby-faradayno fix listedUBUNTU-CVE-2026-33637
Ubuntu:26.04:LTSruby-faradayno fix listedUBUNTU-CVE-2026-33637
Ubuntu:26.10ruby-faradayno fix listedUBUNTU-CVE-2026-33637

Affected products (as reported)

VendorProductVersions
lostisland faraday >= 2.0.0, <= 2.14.2

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

References