CVE-2026-54297: lostisland Faraday uncontrolled recursion in NestedParamsEncoder

CVE-2026-54297 · Severity: high · CVSS 7.5 · Published 2026-06-24

Faraday, a popular Ruby library used by applications to communicate with web services, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted web request with deeply nested parameters that causes the application to crash by exhausting its memory stack. This can lead to service outages or instability in any Ruby application that uses Faraday to process user-supplied web links or data.

Technologies: faraday (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-54297 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54297 being exploited in the wild.
How severe is CVE-2026-54297?
High severity, with a CVSS score of 7.5, published 24 June 2026.
Which products and versions are affected?
faraday (RubyGems) <= 2.14.2, ECOSYSTEM:introduced=2.0.0,fixed=2.14.3.
Is there a fix for CVE-2026-54297?
Yes. faraday (RubyGems): upgrade to 2.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54297 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54297?
Check whether you run faraday (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • faraday (RubyGems): upgrade to 2.14.3 or later
    bundle update faraday

Technical details

The Faraday::NestedParamsEncoder component fails to enforce a maximum nesting depth when decoding query strings. An attacker can provide a crafted query string (e.g., a[x][x]...[x]=1) that forces the library to build a deeply nested Ruby Hash. The internal 'dehash' routine recursively traverses this structure without limits, eventually triggering a SystemStackError (stack level too deep). This crash occurs during both direct parsing via Faraday::Utils.parse_nested_query and during standard URL construction via conn.build_url, meaning the crash can happen before any network request is actually sent. The vulnerability is fixed in versions 1.10.6 and 2.14.3 by implementing nesting depth limits.

Affected products

  • lostisland Faraday >= 1.0.0, < 1.10.6; >= 2.0.0, < 2.14.3

Identifiers

  • CVE-2026-54297
  • GHSA-98m9-hrrm-r99r

Timeline

  • 2026-05-24: other: Vulnerability confirmed via local testing
  • 2026-06-18: advisory: GitHub Security Advisory published
  • 2026-06-24: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.