Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

lostisland/faraday

              main @ 3725183
            

Fixes

CVEs

HIGH

Peak severity

Highlights

SSRF: 2 prior fixes. Scrutinize any change in this area.

Faraday::Connection: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: Attackers can bypass the relative-URL guard using protocol-relative paths to override the connection's pre-configured base host, redirecting requests to arbitrary external servers. This is tracked under CVE-2026-25765 and was fixed by enforcing a strict protocol-relative URL prefix check.

SSRF: A host override / open redirect vulnerability exists when a URI object containing a protocol-relative path is supplied directly to the connection builder. This requires converting incoming URI-like objects to strings properly to ensure the host component is not unexpectedly overridden during string concatenation, tracked under CVE-2026-33637.