{"action":"Upgrade faraday to 2.14.2 or later.","affected":[{"fixed":"2.14.2","introduced":"2.0.0"}],"component":"faraday","cve_ids":["CVE-2026-33637"],"ecosystem":"RubyGems","epss":0.00272,"exploited":false,"fixed_versions":["2.14.2"],"ghsa_id":"GHSA-5rv5-xj5j-3484","id":"tcs_01M5KEH40PH1NG0RWWTHDWK621","modified_at":"2026-09-10T03:51:04.731948847Z","published_at":"2026-05-18T14:51:51Z","references":["https://osv.dev/vulnerability/GHSA-5rv5-xj5j-3484","https://github.com/lostisland/faraday/security/advisories/GHSA-5rv5-xj5j-3484","https://nvd.nist.gov/vuln/detail/CVE-2026-33637","https://github.com/advisories/GHSA-33mh-2634-fwr2","https://github.com/lostisland/faraday","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/faraday/CVE-2026-33637.yml"],"severity":{"label":"unknown","score":0},"sources":[{"source":"osv","source_id":"GHSA-5rv5-xj5j-3484","url":"https://osv.dev/vulnerability/GHSA-5rv5-xj5j-3484"}],"summary":"Faraday has a possible incomplete fix for GHSA-33mh-2634-fwr2: protocol-relative URI objects still bypass host scoping"}