CVE-2026-110222: Server-Side Request Forgery (SSRF) in Razorpay IFSC

The vulnerability exists in Razorpay IFSC Ruby gem versions up to 2.0.62. Attackers can exploit the SSRF flaw by supplying specially crafted IFSC codes to the IFSC.find or IFSC#get methods. These inputs are processed by URI.join, which can resolve network-path references or absolute URIs as new hosts, leading the application to send GET requests to unintended internal or external hosts and return parsed response data. This behavior enables attackers to potentially access internal network resources or attacker-controlled endpoints via the vulnerable API.

Successful exploitation allows an unauthenticated attacker to cause the server to make arbitrary HTTP GET requests to internal or external hosts. This can lead to information disclosure about internal network resources or interaction with attacker-controlled systems. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality.

No explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted input for IFSC codes or restrict network access from the server to sensitive internal resources to mitigate potential SSRF exploitation.