CVE-2026-54297 Details
Description
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. From 1.0.0 until 1.10.6 and 2.14.3, Faraday::NestedParamsEncoder, the default nested query parameter encoder/decoder in Faraday, decodes nested query strings without enforcing a maximum nesting depth. A crafted query string causes Faraday to build a deeply nested Ruby Hash structure. The internal dehash routine then recursively walks this attacker-controlled structure without a depth limit. At sufficient depth, Ruby raises an uncaught SystemStackError (stack level too deep), crashing the calling thread or worker. This can lead to denial of service in applications that pass attacker-controlled query strings to Faraday's nested query parsing or URL-building paths. This vulnerability is fixed in 1.10.6 and 2.14.3.
A denial-of-service vulnerability has been identified in the Faraday HTTP client library, specifically in versions 1.0.0 through 1.10.5 and 2.14.2 prior to 2.14.3. The issue arises in the default nested query parameter encoder/decoder, Faraday::NestedParamsEncoder, which decodes nested query strings without a maximum depth limit. This flaw allows a crafted query string to create a deeply nested Ruby Hash structure. The internal dehash routine recursively processes this attacker-controlled structure, eventually causing a SystemStackError due to excessive depth, and crashing the affected thread or worker. The vulnerability can be exploited in applications that use Faraday's nested query parsing or URL-building features with untrusted query strings.
Users can upgrade to Faraday versions 1.10.6 or 2.14.3, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:50221 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:50222 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:50223 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:50263 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-54297 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2492252 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54297.json | redhat-SADP | |
| https://github.com/lostisland/faraday/security/advisories/GHSA-98m9-hrrm-r99r | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/lostisland/faraday/security/advisories/GHSA-98m9-hrrm-r99r | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| faraday project faraday | >= 1.0.0, < 1.10.6 >= 2.0.0, < 2.14.3 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 14, 2026 | CVE Modified | redhat-SADP |
| Aug 5, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |