CVE-2026-25765

Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Prior to 2.14.1, Faraday's build_exclusive_url method (in lib/faraday/connection.rb) uses Ruby's URI#merge to combine the connection's base URL with a user-supplied path. Per RFC 3986, protocol-relative URLs (e.g. //evil.com/path) are treated as network-path references that override the base URL's host/authority component. This means that if any application passes user-controlled input to Faraday's get(), post(), build_url(), or other request methods, an attacker can supply a protocol-relative URL like //attacker.com/endpoint to redirect the request to an arbitrary host, enabling Server-Side Request Forgery (SSRF). This vulnerability is fixed in 2.14.1.

• CWE-918

• https://github.com/lostisland/faraday/commit/a6d3a3a0bf59c2ab307d0abd91bc126aef5561bcPatch
• https://github.com/lostisland/faraday/releases/tag/v2.14.1Product, Release Notes
• https://github.com/lostisland/faraday/security/advisories/GHSA-33mh-2634-fwr2Mitigation, Vendor Advisory

Published

Feb 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2576The Business Directory Plugin – Easy Listing Directories for…7.5
• CVE-2026-25760Sliver is a command and control framework that uses a custom…6.5
• CVE-2026-25761Super-linter is a combination of multiple linters to run as …8.8
• CVE-2026-25762AdonisJS is a TypeScript-first web framework. Prior to versi…7.5
• CVE-2026-25763OpenProject is an open-source, web-based project management …9.9
• CVE-2026-25764OpenProject is an open-source, web-based project management …3.5
• CVE-2026-25766Echo is a Go web framework. In versions 5.0.0 through 5.0.2 …5.3
• CVE-2026-25767LavinMQ is a high-performance message queue & streaming serv…8.1
• CVE-2026-25768LavinMQ is a high-performance message queue & streaming serv…6.5
• CVE-2026-25769Wazuh is a free and open source platform used for threat pre…9.1
• CVE-2026-2577The WhatsApp bridge component in Nanobot binds the WebSocket…10
• CVE-2026-25770Wazuh is a free and open source platform used for threat pre…7.2