CVE-2026-33637 Faraday: Protocol-relative URI objects still bypass host scoping (possible incomplete fix for GHSA-33mh-2634-fwr2)
Attackers can bypass host scoping in Faraday HTTP client to redirect requests to malicious hosts, leaking sensitive headers and parameters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33637?
CVE-2026-33637 is a server-side request forgery vulnerability in lostisland faraday, published on 19 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object (rather than a String) to Faraday::Connection#build_exclusive_url. This bypasses the February 2026 fix for GHSA-33mh-2634-fwr2 and enables off-host request forgery: a request built from a fixed-base Faraday::Connection can be redirected to an attacker-controlled host, forwarding connection-scoped values such as Authorization headers and default query parameters. This issue has been fixed in version 2.14.3.
Weakness: CWE-918
Which versions are affected by CVE-2026-33637?
2 open source packages ship an affected version, including faraday. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
faraday RubyGems | From 2.0.0 | 2.14.2 |
faraday RubyGems | From 2.0.0 | 2.14.2 |
Products include Faraday Project Faraday.
How do I fix CVE-2026-33637?
Upgrade faraday to 2.14.2 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-33637 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33637 exists.
Other vulnerabilities in lostisland faraday
Sources
Also known as CLEANSTART-2026-LW94044, CLEANSTART-2026-TE06147, DEBIAN-CVE-2026-33637, GHSA-5rv5-xj5j-3484, MINI-5rfv-cmg2-qqxc, MINI-5vwc-99wm-6fpm and 24 more.