CVE-2026-33637: Faraday has a possible incomplete fix for GHSA-33mh-2634-fwr2: protocol-relative URI objects still bypass host scoping

May 18, 2026 (updated June 5, 2026)

Faraday::Connection#build_exclusive_url still allows protocol-relative host override when the request target is provided as a URI object instead of a String. This bypasses the February 2026 fix for GHSA-33mh-2634-fwr2 and can redirect a request built from a fixed-base Faraday::Connection to an attacker-controlled host while preserving connection-scoped headers such as Authorization.

References

github.com/advisories/GHSA-33mh-2634-fwr2
github.com/advisories/GHSA-5rv5-xj5j-3484
github.com/lostisland/faraday/security/advisories/GHSA-5rv5-xj5j-3484
github.com/rubysec/ruby-advisory-db/blob/master/gems/faraday/CVE-2026-33637.yml
nvd.nist.gov/vuln/detail/CVE-2026-33637

Code Behaviors & Features

Detect and mitigate CVE-2026-33637 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →