CVE-2026-33637
Fixed in a distro release EPSS <1%
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object (rather than a String) to Faraday::Connection#build_exclusive_url. This bypasses the February 2026 fix for GHSA-33mh-2634-fwr2 and enables off-host request forgery: a request built from a fixed-base Faraday::Connection can be redirected to an attacker-controlled host, forwarding connection-scoped values such as Authorization headers and default query parameters. This issue has been fixed in version 2.14.3.
Products: lostisland faraday
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | faraday | 2.14.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | cinc-auditor | 7.1.7-r0 |
| Chainguard | gitlab-exporter-18.10 | no fix |
| Chainguard | gitlab-exporter-18.11 | 18.11.5-r2 |
| Chainguard | gitlab-exporter-18.9 | no fix |
| Chainguard | gitlab-exporter-19.0 | 19.0.2-r1 |
| Chainguard | gitlab-exporter-19.1 | 19.1.1-r3 |
| Chainguard | gitlab-rails-ce-18.1 | no fix |
| Chainguard | gitlab-rails-ce-18.10 | no fix |
| Chainguard | gitlab-rails-ce-18.11 | 18.11.5-r2 |
| Chainguard | gitlab-rails-ce-18.3 | no fix |
| Chainguard | gitlab-rails-ce-18.4 | no fix |
| Chainguard | gitlab-rails-ce-18.5 | no fix |
| Chainguard | gitlab-rails-ce-18.6 | no fix |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.10 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.11 | 18.11.5-r2 |
| Chainguard | gitlab-rails-ce-fips-18.3 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.4 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.5 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | no fix |
| Chainguard | gitlab-rails-ce-fips-19.0 | 19.0.2-r2 |
| Chainguard | kube-fluentd-operator | 1.18.2-r70 |
| Chainguard | logstash-8.19 | 8.19.15-r1 |
| Chainguard | logstash-8.19-iamguarded-compat | 8.19.15-r1 |
| Chainguard | logstash-8.19-with-output-opensearch | 8.19.15-r1 |
| Chainguard | logstash-9.0 | 9.0.8-r23 |
| Chainguard | logstash-9.0-iamguarded-compat | 9.0.8-r23 |
| Chainguard | logstash-9.0-with-output-opensearch | 9.0.8-r23 |
| Chainguard | logstash-9.1 | 9.1.10-r8 |
| Chainguard | logstash-9.1-bitnami-compat | 9.1.10-r8 |
| Chainguard | logstash-9.1-iamguarded-compat | 9.1.10-r8 |
| Chainguard | logstash-9.1-with-output-opensearch | 9.1.10-r8 |
| Chainguard | logstash-9.2 | 9.2.8-r4 |
| Chainguard | logstash-9.2-iamguarded-compat | 9.2.8-r4 |
| Chainguard | logstash-9.2-with-output-opensearch | 9.2.8-r4 |
| Chainguard | logstash-9.3 | 9.3.4-r4 |
| Chainguard | logstash-9.3-iamguarded-compat | 9.3.4-r4 |
| Chainguard | logstash-9.4 | 9.4.1-r2 |
| Chainguard | logstash-9.4-iamguarded-compat | 9.4.1-r2 |
| Chainguard | logstash-fips-9.4 | 9.4.1-r2 |
| Chainguard | logstash-fips-9.4-iamguarded-compat | 9.4.1-r2 |
| Chainguard | ruby3.2-kube-logging-operator-fluentd-outputs | 6.5.2-r0 |
| Chainguard | ruby3.4-kube-logging-operator-fluentd-outputs | 6.5.2-r0 |
| Debian 14 | ruby-faraday | 2.14.3-1 |
| Ubuntu 14.04 LTS | ruby-faraday | no fix |
| Ubuntu 16.04 LTS | ruby-faraday | no fix |
| Ubuntu 18.04 LTS | ruby-faraday | no fix |
| Ubuntu 20.04 LTS | ruby-faraday | no fix |
| Ubuntu 22.04 LTS | ruby-faraday | no fix |
| Ubuntu 24.04 LTS | ruby-faraday | no fix |
| Ubuntu 25.10 | ruby-faraday | no fix |
| Ubuntu 26.04 LTS | ruby-faraday | no fix |
| Ubuntu 26.10 | ruby-faraday | no fix |
| Wolfi | cinc-auditor | 7.1.7-r0 |
| Wolfi | kube-fluentd-operator | 1.18.2-r70 |
| Wolfi | logstash-9.3 | 9.3.4-r4 |
| Wolfi | logstash-9.3-iamguarded-compat | 9.3.4-r4 |
| Wolfi | logstash-9.4 | 9.4.1-r2 |
| Wolfi | logstash-9.4-iamguarded-compat | 9.4.1-r2 |
| Wolfi | ruby3.2-kube-logging-operator-fluentd-outputs | 6.5.2-r0 |
| Wolfi | ruby3.4-kube-logging-operator-fluentd-outputs | 6.5.2-r0 |