CVE-2026-33637 Details
Description
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object (rather than a String) to Faraday::Connection#build_exclusive_url. This bypasses the February 2026 fix for GHSA-33mh-2634-fwr2 and enables off-host request forgery: a request built from a fixed-base Faraday::Connection can be redirected to an attacker-controlled host, forwarding connection-scoped values such as Authorization headers and default query parameters. This issue has been fixed in version 2.14.3.
A vulnerability in the Faraday HTTP client library, affecting versions 2.0.0 through 2.14.1, allows for off-host request forgery. This issue arises because protocol-relative URLs can override the host of a request when the target is provided as a URI object to the 'Faraday::Connection#build_exclusive_url' method. As a result, requests can be redirected to an attacker-controlled host, while still forwarding connection-scoped values such as Authorization headers and default query parameters. This vulnerability exploits a flaw in how Faraday handles user-supplied input, bypassing a previous fix implemented in February 2026.
Users are advised to upgrade to Faraday version 2.14.2 or 1.10.5. If an immediate upgrade is not possible, validate and sanitize user input before passing it to Faraday request methods. Reject or strip input that starts with '//' followed by a non-'/' character, use an allowlist of permitted path prefixes, or prepend './' to all user-supplied paths before passing them to Faraday.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lostisland/faraday/security/advisories/GHSA-5rv5-xj5j-3484 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/advisories/GHSA-33mh-2634-fwr2 | [email protected] | Vendor Advisory |
| https://github.com/lostisland/faraday/security/advisories/GHSA-5rv5-xj5j-3484 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| faraday project faraday | >= 2.0.0, < 2.14.2 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | Initial Analysis | [email protected] |
| May 19, 2026 | New CVE Received | [email protected] |
| May 19, 2026 | CVE Modified | CISA-ADP |