MEDIUM5.8RubyGems
GHSA-33mh-2634-fwr2· CVE-2026-25765Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url
Modified: 9/10/2026
package
RubyGems/faraday
pkg:rubygems/faraday
—0.0RubyGems
GHSA-5rv5-xj5j-3484· CVE-2026-33637Faraday has a possible incomplete fix for GHSA-33mh-2634-fwr2: protocol-relative URI objects still bypass host scoping
Modified: 9/10/2026
HIGH7.5RubyGems
GHSA-98m9-hrrm-r99r· CVE-2026-54297Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters
Modified: 9/10/2026