CVE-2026-25765: Faraday SSRF Vulnerability via Protocol-Relative URL Host Override
Summary
CVE-2026-25765: Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url. Affects faraday versions < 2.14.1. Fixed in 2.14.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Faraday is a popular HTTP client library for Ruby, designed to simplify the process of making HTTP requests. It provides a flexible interface for building connections and supports various adapters for different HTTP backends. However, Faraday is vulnerable to a Server-Side Request Forgery (SSRF) issue due to improper handling of user-supplied URLs in its request methods.
Vulnerability Detail
The vulnerability arises from Faraday's build_exclusive_url method, which uses Ruby's URI#merge to combine the base URL with user-supplied paths. According to RFC 3986, protocol-relative URLs (e.g., //evil.com/path) can override the base URL's host component, allowing an attacker to redirect requests to arbitrary hosts. This can lead to SSRF attacks, where an attacker can exploit the application to send requests to internal services or external malicious endpoints.
How To Fix
Minimum fixed version
2.14.1
This is the first release that contains the fix.
gem install faraday -v 2.14.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, you can implement input validation to mitigate the risk. Here is an example of how to validate user input before passing it to Faraday request methods:
def safe_path(user_input)
raise ArgumentError, 'Invalid path' if user_input.match?(%r{\A//[^/]})
user_input
end
This function raises an error for any input that starts with // followed by a non-/ character.
Conclusion
The SSRF vulnerability in Faraday (CVE-2026-25765) poses a significant risk to applications that utilize user-controlled input in request methods. It is crucial to upgrade to version 2.14.1 or later to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround until the upgrade is completed.
See every vulnerability recorded for faraday →
FAQ
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources.
If your application uses Faraday versions up to 2.14.0 and allows user-controlled input in request methods, it may be vulnerable. You can use Vulert to check for vulnerabilities in your application.
SSRF vulnerabilities can lead to data leakage, unauthorized access to internal services, and exploitation of other vulnerabilities within the network.
Yes, you can use tools like Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just a manifest file.
The CVSS score for this vulnerability is 5.8, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for faraday.
