CVE-2026-25765: 
Ruby vulnerability analysis and mitigation

CVE-2026-25765 is a Server-Side Request Forgery (SSRF) vulnerability in the Faraday Ruby HTTP client library, caused by improper handling of protocol-relative URLs in the build_exclusive_url method. An unauthenticated remote attacker can supply a protocol-relative URL (e.g., //attacker.com/endpoint) as user-controlled input to Faraday request methods, causing the server to redirect HTTP requests to an arbitrary external host. Affected versions are Faraday 1.0.0–1.10.4 and 2.0.0–2.14.0; patched versions are 1.10.5 and 2.14.1. IBM API Connect is also listed as an affected product. The vulnerability was published on February 7, 2026, with a CVSS v3.1 base score of 5.8 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper validation of unsafe equivalence in input (CWE-1289) combined with SSRF (CWE-918). The build_exclusive_url method in lib/faraday/connection.rb uses Ruby's URI#merge to combine a configured base URL with a user-supplied path. Per RFC 3986, protocol-relative URLs beginning with // are treated as network-path references that override the host/authority component of the base URL. A prior guard introduced in v2.9.2 (PR #1569) prefixes relative URLs with ./ to prevent misinterpretation, but it explicitly exempts any URL starting with / — meaning //evil.com/path bypasses the guard entirely and is passed directly to URI#+, which replaces the configured host. The fix (commit a6d3a3a) extends the guard condition to also match URLs starting with //, prepending ./ to neutralize the authority component (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to redirect server-side HTTP requests from the vulnerable application to an arbitrary external host, enabling exfiltration of sensitive data (e.g., internal API responses, authentication tokens) to attacker-controlled infrastructure. The scope is marked as "Changed" in CVSS, indicating that the impact extends beyond the vulnerable component itself to other systems reachable by the server. Integrity and availability are not directly impacted, but confidentiality is at risk wherever user-controlled input is passed to Faraday request methods without sanitization (GitHub Advisory, Red Hat Bugzilla).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.009% (0.02% per GitHub Advisory, 6th percentile), indicating a low near-term exploitation probability. The vulnerability requires no privileges or user interaction, making it trivially exploitable in any application that passes user-controlled input to Faraday request methods. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was discovered by a researcher identified as "neo-ai-engineer" and reported by "theamanrawat" (GitHub Advisory).

1. Identify a vulnerable target: Find a web application using Faraday versions 1.0.0–1.10.4 or 2.0.0–2.14.0 that passes user-controlled input (e.g., a URL path parameter, API endpoint field) to Faraday's get(), post(), build_url(), or similar methods.
2. Craft a protocol-relative URL payload: Prepare a payload such as //attacker.com/collect or //attacker.com:8080/steal that begins with // followed by an attacker-controlled hostname.
3. Inject the payload: Submit the crafted protocol-relative URL as the user-controlled input to the vulnerable application endpoint (e.g., via a query parameter, form field, or API request body).
4. Trigger the SSRF: The application passes the unsanitized input to Faraday's build_exclusive_url, which — due to the bypassed guard — calls URI#+ with the protocol-relative URL, overriding the configured base host and sending the HTTP request to the attacker's server.
5. Collect exfiltrated data: Monitor the attacker-controlled server for incoming requests, which may contain sensitive headers, tokens, or response data from the application's internal API calls (GitHub Advisory, Patch Commit).

• Network: Outbound HTTP/HTTPS requests from the application server to unexpected external hosts, particularly those not in the application's configured API allowlist; requests with //-prefixed paths in server-side HTTP client logs.
• Logs: Application logs showing Faraday requests resolving to hosts other than the configured url_prefix; error logs indicating unexpected SSL certificate mismatches or connection failures to external domains.
• Application Behavior: API calls returning unexpected responses or errors inconsistent with the configured backend; unusual latency spikes on endpoints that accept user-supplied URL paths.

Upgrade Faraday to version 2.14.1 (for the 2.x branch) or 1.10.5 (for the 1.x branch), which extend the build_exclusive_url guard to also prefix //-starting URLs with ./, neutralizing the authority override (GitHub Advisory, v2.14.1 Release). If upgrading immediately is not possible, sanitize all user-controlled input before passing it to Faraday: reject or strip inputs matching %r{\A//[^/]}, use an allowlist of permitted path prefixes, or prepend ./ to all user-supplied paths. IBM API Connect users should refer to the IBM advisory for product-specific guidance.

The vulnerability was discovered by an AI agent ("neo-ai-engineer") and reported by researcher "theamanrawat", attracting attention in the security community as a notable example of AI-assisted vulnerability discovery. ProjectDiscovery published a blog post titled "How Neo Found an SSRF Vulnerability in Faraday and Why It Matters for Every Team That Ships Code," highlighting the AI-powered discovery angle (ProjectDiscovery Blog). Additional coverage appeared on security blogs and threat intelligence platforms, with the Fluent Package project also releasing an update (v6.0.2) that addresses this CVE as a dependency fix.