CVE-2026-33637

RubyGems/faraday CVE-2026-33637: unknown 0

Faraday has a possible incomplete fix for GHSA-33mh-2634-fwr2: protocol-relative URI objects still bypass host scoping

Action: Upgrade faraday to 2.14.2 or later.

bundle update faraday

Affected

Fixed versions

Sources

• osv: GHSA-5rv5-xj5j-3484
• https://github.com/lostisland/faraday/security/advisories/GHSA-5rv5-xj5j-3484
• https://nvd.nist.gov/vuln/detail/CVE-2026-33637
• https://github.com/advisories/GHSA-33mh-2634-fwr2
• https://github.com/lostisland/faraday
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/faraday/CVE-2026-33637.yml

CVE-2026-33637 · published 2026-05-18T14:51:51Z · modified 2026-09-10T03:51:04.731948847Z · JSON