Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object (rather than a String) to Faraday::Connection#build_exclusive_url. This bypasses the February 2026 fix for GHSA-33mh-2634-fwr2 and enables off-host request forgery: a request built from a fixed-base Faraday::Connection can be redirected to an attacker-controlled host, forwarding connection-scoped values such as Authorization headers and default query parameters. This issue has been fixed in version 2.14.3.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-33637 Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative h… https://www.cve.org/CVERecord?id=CVE-2026-33637
Post summary
The post simply references CVE-2026-33637 and indicates affected Faraday versions, without providing exploit, patch, or detailed technical information.
CVE-2026-33637 Protocol-Relative Host Override in Faraday HTTP Client Library Versions 2.0.0-2.14.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33637
Post summary
The post lists CVE‑2026‑33637 and provides a terse technical description of a protocol‑relative host override issue in Faraday HTTP Client but offers no exploit, patch, or exploitation evidence.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | faraday_project | faraday | - | - | - |