ruby-faraday: Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters
CVE-2026-33637 is fixed in ruby-faraday on 1 platform by DEBIAN-CVE-2026-33637 (version 2.14.3-1), released May 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object (rather than a String) to Faraday::Connection#build_exclusive_url. This bypasses the February 2026 fix for GHSA-33mh-2634-fwr2 and enables off-host request forgery: a request built from a fixed-base Faraday::Connection can be redirected to an attacker-controlled host, forwarding connection-scoped values such as Authorization headers and default query parameters. This issue has been fixed in version 2.14.3.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| ruby-faraday · Debian 14 | 2.14.3-1 | DEBIAN-CVE-2026-33637 | May 19, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.