Bug 2438241 (CVE-2026-25765)

Summary: CVE-2026-25765 Faraday: Faraday: Server-Side Request Forgery via protocol-relative URLs
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akostadi, amasferr, dmayorov, jcantril, jlledo, jvasik, kaycoth, pantinor, rblanco, rojacob, tsedmik, vmugicag
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Faraday, an HTTP client library. The `build_exclusive_url` method, which combines a base URL with a user-supplied path, incorrectly processes protocol-relative URLs (e.g., //evil.com/path). This allows a remote attacker to supply a specially crafted URL, leading to Server-Side Request Forgery (SSRF). An attacker can exploit this to redirect requests to an arbitrary host, potentially accessing internal resources or bypassing security controls.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-02-09 21:01:24 UTC 
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Prior to 2.14.1, Faraday's build_exclusive_url method (in lib/faraday/connection.rb) uses Ruby's URI#merge to combine the connection's base URL with a user-supplied path. Per RFC 3986, protocol-relative URLs (e.g. //evil.com/path) are treated as network-path references that override the base URL's host/authority component. This means that if any application passes user-controlled input to Faraday's get(), post(), build_url(), or other request methods, an attacker can supply a protocol-relative URL like //attacker.com/endpoint to redirect the request to an arbitrary host, enabling Server-Side Request Forgery (SSRF). This vulnerability is fixed in 2.14.1.