CVE-2026-54297: CWE-674: Uncontrolled Recursion in lostisland faraday
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. From 1.0.0 until 1.10.6 and 2.14.3, Faraday::NestedParamsEncoder, the default nested query parameter encoder/decoder in Faraday, decodes nested query strings without enforcing a maximum nesting depth. A crafted query string causes Faraday to build a deeply nested Ruby Hash structure. The internal dehash routine then recursively walks this attacker-controlled structure without a depth limit. At sufficient depth, Ruby raises an uncaught SystemStackError (stack level too deep), crashing the calling thread or worker. This can lead to denial of service in applications that pass attacker-controlled query strings to Faraday's nested query parsing or URL-building paths. This vulnerability is fixed in 1.10.6 and 2.14.3.
AI Analysis
Technical Summary
Faraday versions from 1.0.0 up to but not including 1.10.6 and from 2.0.0 up to but not including 2.14.3 contain a vulnerability in Faraday::NestedParamsEncoder, which does not enforce a maximum nesting depth when decoding nested query strings. This allows an attacker to craft a deeply nested query string that causes Faraday to build a deeply nested Ruby Hash structure. The internal recursive dehash routine then walks this structure without depth limits, leading to a SystemStackError (stack level too deep) that crashes the calling thread or worker. This results in a denial of service condition in applications using Faraday for nested query parsing or URL building. The vulnerability is tracked as CWE-674 (Uncontrolled Recursion) and CWE-770 (Allocation of Resources Without Limits or Throttling). Red Hat has acknowledged the issue and rated it as important, but currently states that no mitigation other than upgrading is available. The fix is included in Faraday versions 1.10.6 and 2.14.3.
Potential Impact
The vulnerability allows remote attackers to cause a denial of service by sending specially crafted nested query strings to applications using vulnerable versions of Faraday. This triggers unbounded recursion in Faraday's nested query parameter decoding, resulting in a SystemStackError that crashes the processing thread or worker. There is no impact on confidentiality or integrity, but availability is severely affected due to application crashes.
Mitigation Recommendations
A fix is available in Faraday versions 1.10.6 and 2.14.3. Users should upgrade to these or later versions to remediate the vulnerability. Red Hat currently states that no alternative mitigation is available that meets their criteria for ease of use and applicability. Therefore, upgrading to a fixed version is the recommended action.
CVE-2026-54297: CWE-674: Uncontrolled Recursion in lostisland faraday
Description
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. From 1.0.0 until 1.10.6 and 2.14.3, Faraday::NestedParamsEncoder, the default nested query parameter encoder/decoder in Faraday, decodes nested query strings without enforcing a maximum nesting depth. A crafted query string causes Faraday to build a deeply nested Ruby Hash structure. The internal dehash routine then recursively walks this attacker-controlled structure without a depth limit. At sufficient depth, Ruby raises an uncaught SystemStackError (stack level too deep), crashing the calling thread or worker. This can lead to denial of service in applications that pass attacker-controlled query strings to Faraday's nested query parsing or URL-building paths. This vulnerability is fixed in 1.10.6 and 2.14.3.
CVSS v3.1
Score 7.5high
Affected software
lostisland
faraday
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Faraday versions from 1.0.0 up to but not including 1.10.6 and from 2.0.0 up to but not including 2.14.3 contain a vulnerability in Faraday::NestedParamsEncoder, which does not enforce a maximum nesting depth when decoding nested query strings. This allows an attacker to craft a deeply nested query string that causes Faraday to build a deeply nested Ruby Hash structure. The internal recursive dehash routine then walks this structure without depth limits, leading to a SystemStackError (stack level too deep) that crashes the calling thread or worker. This results in a denial of service condition in applications using Faraday for nested query parsing or URL building. The vulnerability is tracked as CWE-674 (Uncontrolled Recursion) and CWE-770 (Allocation of Resources Without Limits or Throttling). Red Hat has acknowledged the issue and rated it as important, but currently states that no mitigation other than upgrading is available. The fix is included in Faraday versions 1.10.6 and 2.14.3.
Potential Impact
The vulnerability allows remote attackers to cause a denial of service by sending specially crafted nested query strings to applications using vulnerable versions of Faraday. This triggers unbounded recursion in Faraday's nested query parameter decoding, resulting in a SystemStackError that crashes the processing thread or worker. There is no impact on confidentiality or integrity, but availability is severely affected due to application crashes.
Mitigation Recommendations
A fix is available in Faraday versions 1.10.6 and 2.14.3. Users should upgrade to these or later versions to remediate the vulnerability. Red Hat currently states that no alternative mitigation is available that meets their criteria for ease of use and applicability. Therefore, upgrading to a fixed version is the recommended action.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-12T17:46:37.293Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-54297","vendor":"Red Hat"}]
Threat ID: 6a3c04afeed863c81e18d763
Added to database: 06/24/2026, 16:24:15 UTC
Last enriched: 08/14/2026, 13:10:38 UTC
Last updated: 09/21/2026, 22:01:35 UTC
Views: 132
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.