CVE-2026-33637: lostisland Faraday SSRF via protocol-relative URI objects

CVE-2026-33637 · Severity: low · CVSS 3.1 · Published 2026-05-19

Faraday is a popular Ruby library used by developers to make web requests. A security flaw allows an attacker to redirect web requests intended for a trusted server to a malicious one if the application uses certain input types. This could lead to the exposure of sensitive information, such as authorization tokens or private API keys, to an unauthorized third party.

Technologies: faraday (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-33637 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33637 being exploited in the wild.
How severe is CVE-2026-33637?
Low severity, with a CVSS score of 3.1, published 19 May 2026.
Which products and versions are affected?
faraday (RubyGems) >= 2.0.0, <= 2.14.1, ECOSYSTEM:introduced=2.0.0,fixed=2.14.2.
Is there a fix for CVE-2026-33637?
Yes. faraday (RubyGems): upgrade to 2.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33637 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-33637?
Check whether you run faraday (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • faraday (RubyGems): upgrade to 2.14.2 or later
    bundle update faraday

Technical details

A vulnerability in Faraday::Connection#build_exclusive_url allows for a protocol-relative host override (e.g., '//attacker.com') when the request target is provided as a URI object rather than a String. This behavior bypasses a previous fix (GHSA-33mh-2634-fwr2) which only addressed String-based inputs. An attacker who can influence the path passed to request methods (like get or post) can redirect the request to an arbitrary host. Because the request is built from an existing Faraday::Connection, connection-scoped metadata—including Authorization headers and default query parameters—are forwarded to the attacker-controlled destination. The issue is fixed in version 2.14.2 (and 2.14.3).

Affected products

  • lostisland faraday >= 2.0.0, <= 2.14.1

Identifiers

  • CVE-2026-33637
  • GHSA-5rv5-xj5j-3484

Timeline

  • 2026-02-07: other: Original string-based SSRF (CVE-2026-25765) disclosed
  • 2026-05-18: advisory: GitHub Advisory GHSA-5rv5-xj5j-3484 published for URI object bypass
  • 2026-05-19: disclosed: CVE-2026-33637 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.