Executive brief
Faraday, a popular Ruby library used by applications to communicate with web services, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted web request with deeply nested parameters that causes the application to crash by exhausting its memory stack. This can lead to service outages or instability in any Ruby application that uses Faraday to process user-supplied web links or data.
Technical details
The Faraday::NestedParamsEncoder component fails to enforce a maximum nesting depth when decoding query strings. An attacker can provide a crafted query string (e.g., a[x][x]...[x]=1) that forces the library to build a deeply nested Ruby Hash. The internal 'dehash' routine recursively traverses this structure without limits, eventually triggering a SystemStackError (stack level too deep). This crash occurs during both direct parsing via Faraday::Utils.parse_nested_query and during standard URL construction via conn.build_url, meaning the crash can happen before any network request is actually sent. The vulnerability is fixed in versions 1.10.6 and 2.14.3 by implementing nesting depth limits.
Affected products
- lostisland Faraday >= 1.0.0, < 1.10.6; >= 2.0.0, < 2.14.3
Timeline
- 2026-05-24: other: Vulnerability confirmed via local testing
- 2026-06-18: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: NVD publication date