GHSA-98m9-hrrm-r99r

Suggest an improvement
Source
https://github.com/advisories/GHSA-98m9-hrrm-r99r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-98m9-hrrm-r99r/GHSA-98m9-hrrm-r99r.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-98m9-hrrm-r99r
Aliases
Downstream
CGA (96)
MINI (27)
Published
2026-06-19T19:35:43Z
Modified
2026-09-10T03:50:49Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters
Details

Faraday::NestedParamsEncoder, the default nested query parameter encoder/decoder in Faraday, decodes nested query strings without enforcing a maximum nesting depth.

A crafted query string such as:

a[x][x][x][x]...[x]=1

causes Faraday to build a deeply nested Ruby Hash structure. The internal dehash routine then recursively walks this attacker-controlled structure without a depth limit. At sufficient depth, Ruby raises an uncaught SystemStackError (stack level too deep), crashing the calling thread or worker. This can lead to denial of service in applications that pass attacker-controlled query strings to Faraday's nested query parsing or URL-building paths.

This has been patched in version 2.14.3 and backported to 1.10.6.

Database specific 
{
    "cwe_ids":  [
        "CWE-674"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-19T19:35:43Z",
    "nvd_published_at":  "2026-06-24T17:17:29Z",
    "severity":  "HIGH"
}
References

Affected packages

RubyGems / faraday

Package

Name
faraday
Purl
pkg:gem/faraday

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.14.3

Affected versions

2.*
2.0.0
2.0.1
2.1.0
2.2.0
2.3.0
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.7.10
2.7.11
2.7.12
2.8.0
2.8.1
2.9.0
2.9.1
2.9.2
2.10.0
2.10.1
2.11.0
2.12.0
2.12.1
2.12.2
2.12.3
2.13.0
2.13.1
2.13.2
2.13.3
2.13.4
2.14.0
2.14.1
2.14.2

Database specific

last_known_affected_version_range 
"<= 2.14.2"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-98m9-hrrm-r99r/GHSA-98m9-hrrm-r99r.json"

RubyGems / faraday

Package

Name
faraday
Purl
pkg:gem/faraday

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.0.0
Fixed
1.10.6

Affected versions

1.*
1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.9.0
1.9.1
1.9.2
1.9.3
1.10.0
1.10.1
1.10.2
1.10.3
1.10.4
1.10.5

Database specific

last_known_affected_version_range 
"<= 1.10.5"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-98m9-hrrm-r99r/GHSA-98m9-hrrm-r99r.json"