CVE catalog

CVE-2026-54297

Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. From 1.0.0 until 1.10.6 and 2.14.3, Faraday::NestedParamsEncoder, the default nested query para

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.76% · Oct 25, 2026

Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. From 1.0.0 until 1.10.6 and 2.14.3, Faraday::NestedParamsEncoder, the default nested query parameter encoder/decoder in Faraday, decodes nested query strings without enforcing a maximum nesting depth. A crafted query string causes Faraday to build a deeply nested Ruby Hash structure. The internal dehash routine then recursively walks this attacker-controlled structure without a depth limit. At sufficient depth, Ruby raises an uncaught SystemStackError (stack level too deep), crashing the calling thread or worker. This can lead to denial of service in applications that pass attacker-controlled query strings to Faraday's nested query parsing or URL-building paths. This vulnerability is fixed in 1.10.6 and 2.14.3.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-faradaysid2.15.0-1fixed
Debianruby-faradayforky2.15.0-1fixed
Debianruby-faradaytrixie2.12.2-1vulnerable
Debianruby-faradaybookworm1.1.0-7vulnerable
Cperuby-faradayNot reportedNot reportedvulnerable
CpefaradayNot reported1.10.6fixed
CpefaradayNot reported2.14.3fixed
Ubunturuby-faraday14.040.8.7-1vulnerable
Ubunturuby-faraday16.040.9.1-1vulnerable
Ubunturuby-faraday16.040.9.2-3vulnerable
Ubunturuby-faraday18.040.9.2-3vulnerable
Ubunturuby-faraday20.040.15.4-3vulnerable
Ubunturuby-faraday20.040.15.4-3ubuntu0.1vulnerable
Ubunturuby-faraday22.041.1.0-6vulnerable
Ubunturuby-faraday22.041.1.0-7vulnerable
Ubunturuby-faraday24.041.1.0-7vulnerable
Ubunturuby-faraday24.042.7.1-2vulnerable
Ubunturuby-faraday25.102.10.0-2vulnerable
Ubunturuby-faraday25.102.12.2-1vulnerable
Ubunturuby-faraday26.042.12.2-1vulnerable
Ubunturuby-faraday26.042.14.0-1vulnerable
Ubunturuby-faraday26.042.14.1-1vulnerable
CpefaradayNot reported2.14.3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-faradaysourcesid2.14.3-1not yet assignedNot reportedNot reported
Debianruby-faradaysourceforky2.14.3-1not yet assignedNot reportedNot reported
Debianruby-faradaysourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianruby-faradaysourcebookworm(unfixed)not yet assignedNot reportedNot reported
CpefaradaycpeNot reported1.10.6Not reportedNot reportedNot reported
CpefaradaycpeNot reported2.14.3Not reportedNot reportedNot reported
CpefaradaycpeNot reported2.14.3Not reportedNVD-CVE-2026-54297Not reported

Notes

[trixie] ruby-faraday: Minor issue [bookworm] ruby-faraday: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ruby-faraday]Affected
    Details (2)

    • 1.1.0-7 · all · bookworm

      Affected

      nvd · ruby-faraday · debian · bookworm; nvd · ruby-faraday · debian · 12

    • 1.1.0-7 · all · bookworm

      Affected

      nvd · ruby-faraday · debian · bookworm; nvd · ruby-faraday · debian · 12

[Debian 13 (Trixie)]

  • [ruby-faraday]Affected
    Details (2)

    • 2.12.2-1 · all · trixie

      Affected

      nvd · ruby-faraday · debian · 13

    • 2.12.2-1 · all · trixie

      Affected

      nvd · ruby-faraday · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]