Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-5qz3-p1wh-8bcy
Vulnerability ID VCID-5qz3-p1wh-8bcy
Aliases CVE-2026-25765
GHSA-33mh-2634-fwr2
Summary Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Prior to 2.14.1, Faraday's build_exclusive_url method (in lib/faraday/connection.rb) uses Ruby's URI#merge to combine the connection's base URL with a user-supplied path. Per RFC 3986, protocol-relative URLs (e.g. //evil.com/path) are treated as network-path references that override the base URL's host/authority component. This means that if any application passes user-controlled input to Faraday's get(), post(), build_url(), or other request methods, an attacker can supply a protocol-relative URL like //attacker.com/endpoint to redirect the request to an arbitrary host, enabling Server-Side Request Forgery (SSRF). This vulnerability is fixed in 2.14.1.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-918 Server-Side Request Forgery (SSRF)
CWE-1289 Improper Validation of Unsafe Equivalence in Input
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25765.json
epss 0.00022 https://api.first.org/data/v1/epss?cve=CVE-2026-25765
epss 0.00022 https://api.first.org/data/v1/epss?cve=CVE-2026-25765
epss 0.00022 https://api.first.org/data/v1/epss?cve=CVE-2026-25765
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-33mh-2634-fwr2
cvssv3.1 5.8 https://github.com/lostisland/faraday
generic_textual MODERATE https://github.com/lostisland/faraday
cvssv3.1 5.8 https://github.com/lostisland/faraday/commit/a6d3a3a0bf59c2ab307d0abd91bc126aef5561bc
generic_textual MODERATE https://github.com/lostisland/faraday/commit/a6d3a3a0bf59c2ab307d0abd91bc126aef5561bc
ssvc Track https://github.com/lostisland/faraday/commit/a6d3a3a0bf59c2ab307d0abd91bc126aef5561bc
cvssv3.1 5.8 https://github.com/lostisland/faraday/pull/1569
generic_textual MODERATE https://github.com/lostisland/faraday/pull/1569
cvssv3.1 5.8 https://github.com/lostisland/faraday/releases/tag/v1.10.5
generic_textual MODERATE https://github.com/lostisland/faraday/releases/tag/v1.10.5
cvssv3.1 5.8 https://github.com/lostisland/faraday/releases/tag/v2.14.1
generic_textual MODERATE https://github.com/lostisland/faraday/releases/tag/v2.14.1
ssvc Track https://github.com/lostisland/faraday/releases/tag/v2.14.1
cvssv3 5.8 https://github.com/lostisland/faraday/security/advisories/GHSA-33mh-2634-fwr2
cvssv3.1 5.8 https://github.com/lostisland/faraday/security/advisories/GHSA-33mh-2634-fwr2
cvssv3.1_qr MODERATE https://github.com/lostisland/faraday/security/advisories/GHSA-33mh-2634-fwr2
generic_textual MODERATE https://github.com/lostisland/faraday/security/advisories/GHSA-33mh-2634-fwr2
ssvc Track https://github.com/lostisland/faraday/security/advisories/GHSA-33mh-2634-fwr2
cvssv3.1 5.8 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/faraday/CVE-2026-25765.yml
generic_textual MODERATE https://github.com/rubysec/ruby-advisory-db/blob/master/gems/faraday/CVE-2026-25765.yml
cvssv3.1 5.8 https://nvd.nist.gov/vuln/detail/CVE-2026-25765
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-25765
cvssv3.1 5.8 https://www.rfc-editor.org/rfc/rfc3986#section-5.2.2
generic_textual MODERATE https://www.rfc-editor.org/rfc/rfc3986#section-5.2.2
cvssv3.1 5.8 https://www.rfc-editor.org/rfc/rfc3986#section-5.4
generic_textual MODERATE https://www.rfc-editor.org/rfc/rfc3986#section-5.4
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25765.json
https://api.first.org/data/v1/epss?cve=CVE-2026-25765
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25765
https://github.com/lostisland/faraday
https://github.com/lostisland/faraday/pull/1569
https://github.com/lostisland/faraday/releases/tag/v1.10.5
https://www.rfc-editor.org/rfc/rfc3986#section-5.2.2
https://www.rfc-editor.org/rfc/rfc3986#section-5.4
2438241 https://bugzilla.redhat.com/show_bug.cgi?id=2438241
a6d3a3a0bf59c2ab307d0abd91bc126aef5561bc https://github.com/lostisland/faraday/commit/a6d3a3a0bf59c2ab307d0abd91bc126aef5561bc
CVE-2026-25765 https://nvd.nist.gov/vuln/detail/CVE-2026-25765
CVE-2026-25765.YML https://github.com/rubysec/ruby-advisory-db/blob/master/gems/faraday/CVE-2026-25765.yml
GHSA-33mh-2634-fwr2 https://github.com/advisories/GHSA-33mh-2634-fwr2
GHSA-33mh-2634-fwr2 https://github.com/lostisland/faraday/security/advisories/GHSA-33mh-2634-fwr2
v2.14.1 https://github.com/lostisland/faraday/releases/tag/v2.14.1
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25765.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N Found at https://github.com/lostisland/faraday
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N Found at https://github.com/lostisland/faraday/commit/a6d3a3a0bf59c2ab307d0abd91bc126aef5561bc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-10T15:39:44Z/ Found at https://github.com/lostisland/faraday/commit/a6d3a3a0bf59c2ab307d0abd91bc126aef5561bc
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N Found at https://github.com/lostisland/faraday/pull/1569
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N Found at https://github.com/lostisland/faraday/releases/tag/v1.10.5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N Found at https://github.com/lostisland/faraday/releases/tag/v2.14.1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-10T15:39:44Z/ Found at https://github.com/lostisland/faraday/releases/tag/v2.14.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N Found at https://github.com/lostisland/faraday/security/advisories/GHSA-33mh-2634-fwr2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-10T15:39:44Z/ Found at https://github.com/lostisland/faraday/security/advisories/GHSA-33mh-2634-fwr2
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/faraday/CVE-2026-25765.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-25765
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N Found at https://www.rfc-editor.org/rfc/rfc3986#section-5.2.2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N Found at https://www.rfc-editor.org/rfc/rfc3986#section-5.4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.06394
EPSS Score 0.00022
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:41:25.161273+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/25xxx/CVE-2026-25765.json 38.6.0