CVE-2026-33637: Faraday: Protocol-relative URI objects still bypass host scoping (possible incomplete fix for GHSA-33mh-2634-fwr2)

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-05-19 · updated 2026-07-24
Weakness: CWE-918

Description

Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object (rather than a String) to Faraday::Connection#build_exclusive_url. This bypasses the February 2026 fix for GHSA-33mh-2634-fwr2 and enables off-host request forgery: a request built from a fixed-base Faraday::Connection can be redirected to an attacker-controlled host, forwarding connection-scoped values such as Authorization headers and default query parameters. This issue has been fixed in version 2.14.3.

Affected products

lostisland faraday: from 2.0.0 before 2.14.2 — fixed in 2.14.2

How to fix

Upgrade to a fixed version: lostisland faraday 2.14.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-33637 or the next vulnerability affects your stack