CVE-2026-54297: CWE-674: Uncontrolled Recursion in lostisland faraday
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. From 1.0.0 until 1.10.6 and 2.14.3, Faraday::NestedParamsEncoder, the default nested query parameter encoder/decoder in Faraday, decodes nested query strings without enforcing a maximum nesting depth. A crafted query string causes Faraday to build a deeply nested Ruby Hash structure. The internal dehash routine then recursively walks this attacker-controlled structure without a depth limit. At sufficient depth, Ruby raises an uncaught SystemStackError (stack level too deep), crashing the calling thread or worker. This can lead to denial of service in applications that pass attacker-controlled query strings to Faraday's nested query parsing or URL-building paths. This vulnerability is fixed in 1.10.6 and 2.14.3.
AI Analysis
Technical Summary
Faraday versions before 1.10.6 and 2.14.3 use Faraday::NestedParamsEncoder to decode nested query strings without enforcing a maximum nesting depth. An attacker can send a specially crafted nested query string that causes Faraday to build an excessively deep Ruby Hash structure. The internal dehash routine recursively processes this structure without depth limits, resulting in a SystemStackError due to stack overflow. This causes the application thread or worker to crash, leading to denial of service. The vulnerability is tracked as CWE-674 (Uncontrolled Recursion) and CWE-770 (Allocation of Resources Without Limits or Throttling).
Potential Impact
The vulnerability allows remote attackers to cause a denial of service by crashing the application's processing thread or worker through crafted nested query strings that trigger unbounded recursion and stack overflow. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
A fix is available in Faraday versions 1.10.6 and 2.14.3. Users should upgrade to these or later versions to remediate the vulnerability. The Red Hat advisory notes that mitigation options other than upgrading do not meet their criteria for ease of use and applicability. Therefore, upgrading is the recommended remediation.
CVE-2026-54297: CWE-674: Uncontrolled Recursion in lostisland faraday
Description
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. From 1.0.0 until 1.10.6 and 2.14.3, Faraday::NestedParamsEncoder, the default nested query parameter encoder/decoder in Faraday, decodes nested query strings without enforcing a maximum nesting depth. A crafted query string causes Faraday to build a deeply nested Ruby Hash structure. The internal dehash routine then recursively walks this attacker-controlled structure without a depth limit. At sufficient depth, Ruby raises an uncaught SystemStackError (stack level too deep), crashing the calling thread or worker. This can lead to denial of service in applications that pass attacker-controlled query strings to Faraday's nested query parsing or URL-building paths. This vulnerability is fixed in 1.10.6 and 2.14.3.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Faraday versions before 1.10.6 and 2.14.3 use Faraday::NestedParamsEncoder to decode nested query strings without enforcing a maximum nesting depth. An attacker can send a specially crafted nested query string that causes Faraday to build an excessively deep Ruby Hash structure. The internal dehash routine recursively processes this structure without depth limits, resulting in a SystemStackError due to stack overflow. This causes the application thread or worker to crash, leading to denial of service. The vulnerability is tracked as CWE-674 (Uncontrolled Recursion) and CWE-770 (Allocation of Resources Without Limits or Throttling).
Potential Impact
The vulnerability allows remote attackers to cause a denial of service by crashing the application's processing thread or worker through crafted nested query strings that trigger unbounded recursion and stack overflow. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
A fix is available in Faraday versions 1.10.6 and 2.14.3. Users should upgrade to these or later versions to remediate the vulnerability. The Red Hat advisory notes that mitigation options other than upgrading do not meet their criteria for ease of use and applicability. Therefore, upgrading is the recommended remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-12T17:46:37.293Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-54297","vendor":"Red Hat"}]
Threat ID: 6a3c04afeed863c81e18d763
Added to database: 06/24/2026, 16:24:15 UTC
Last enriched: 08/05/2026, 13:01:23 UTC
Last updated: 08/07/2026, 14:02:56 UTC
Views: 90
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.