CVE-2026-25765

🗓️ 09 Feb 2026 20:30:58Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 85 Views🌐 WEB

Faraday before 2.14.1 is vulnerable to server side request forgery by protocol-relative URLs that override the host in build_exclusive_url.

Reporter	Title	Published	Views	Family All 175
attackerkb	CVE-2026-25765	9 Feb 202620:30	–	attackerkb
BDU FSTEC	The vulnerability of the `build_exclusive_url` method in the Faraday HTTP request processing library for the Ruby programming language allows a attacker to perform an SSRF attack.	2 Jul 202600:00	–	bdu_fstec
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Aspera Orchestrator	10 Mar 202615:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Aspera Console	12 Mar 202620:43	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Faraday affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Aug 202618:24	–	ibm
CBLMariner	CVE-2026-25765 affecting package rubygem-faraday for versions less than 2.7.10-2	16 Apr 202602:25	–	cbl_mariner
Chainguard	CVE-2026-25765 vulnerabilities	16 Feb 202613:17	–	cgr
Circl	CVE-2026-25765	9 Feb 202621:10	–	circl
CNNVD	faraday 代码问题漏洞	9 Feb 202600:00	–	cnnvd
Cvelist	CVE-2026-25765 Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url	9 Feb 202620:30	–	cvelist

NVD

Vulners

Node

faraday_project faradayRange1.0.0–1.10.5

faraday_project faradayRange2.0.0–2.14.1

[
  {
    "vendor": "lostisland",
    "product": "faraday",
    "versions": [
      {
        "version": "< 2.14.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/lostisland/faraday/commit/a6d3a3a0bf59c2ab307d0abd91bc126aef5561bc
github	www.github.com/lostisland/faraday/releases/tag/v2.14.1
github	www.github.com/lostisland/faraday/security/advisories/GHSA-33mh-2634-fwr2

Parameter	Position	Path	Description	CWE
path	path	//evil.com/path	Protocol-relative URL passed as a request path can override the base URL and redirect requests to an arbitrary host (SSRF).	CWE-918
path	path	//attacker.com/endpoint	Protocol-relative URL passed as a request path can override the base URL and redirect to attacker-controlled host (SSRF).	CWE-918

17 Jun 2026 10:25Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.15.8

EPSS0.00446

SSVC

CWE-918