CVE-2026-54297: Faraday HTTP Client DoS Vulnerability

CVE-2026-54297 Overview

CVE-2026-54297 is a denial of service vulnerability in Faraday, a widely used Ruby HTTP client library abstraction layer. The flaw resides in Faraday::NestedParamsEncoder, the default nested query parameter encoder and decoder. The encoder decodes nested query strings without enforcing a maximum nesting depth. Attackers can craft query strings that force Faraday to build a deeply nested Ruby Hash structure. The internal dehash routine recursively walks this attacker-controlled structure without a depth limit. Ruby raises an uncaught SystemStackError at sufficient depth, crashing the calling thread or worker. The vulnerability affects versions from 1.0.0 up to 1.10.6 and 2.14.3.

Critical Impact
Attackers can crash Ruby application threads or workers by submitting crafted query strings to any code path that passes user-controlled input into Faraday's nested query parsing or URL-building functions.

Affected Products

Faraday versions 1.0.0 through 1.10.5
Faraday 2.x versions prior to 2.14.3
Ruby applications using Faraday::NestedParamsEncoder for query string parsing

Discovery Timeline

2026-06-24 - CVE-2026-54297 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-54297

Vulnerability Analysis

The vulnerability is classified as uncontrolled recursion [CWE-674]. Faraday's NestedParamsEncoder accepts query strings containing bracket notation that defines nested data structures. When the encoder decodes input such as a[b][c][d]..., it constructs a nested Ruby Hash mirroring the bracket depth. The internal dehash routine then recursively traverses each level to produce the final decoded structure.

Neither the decoding step nor the dehash traversal enforces a maximum recursion depth. A query string with thousands of nested brackets causes Ruby's call stack to exhaust. The interpreter raises SystemStackError (stack level too deep), which Faraday does not catch. The exception propagates to the calling thread or worker process and terminates it.

Root Cause

The root cause is the absence of depth validation in two locations: the nested parameter decoder that builds the Hash structure, and the dehash routine that traverses it. Both operate recursively on attacker-controlled input. The Ruby runtime imposes no soft limit before the hard stack boundary, so the only outcome is an unhandled exception that terminates execution context.

Attack Vector

Exploitation requires only network access to an endpoint that forwards user-supplied query strings into Faraday's nested parameter parsing or URL construction APIs. No authentication or user interaction is needed. An attacker submits a single HTTP request containing a query string with deeply nested bracket parameters. The application then invokes Faraday with that input and the worker crashes. Repeated requests exhaust worker pools and produce sustained denial of service.

The vulnerability mechanism is documented in the Faraday GitHub Security Advisory. No verified proof-of-concept code is publicly available at this time.

Detection Methods for CVE-2026-54297

Indicators of Compromise

HTTP requests containing query strings with abnormally deep bracket nesting, for example param[a][b][c][d]... exceeding hundreds of levels
Ruby application logs containing SystemStackError: stack level too deep originating from Faraday::NestedParamsEncoder or dehash stack frames
Unexpected worker process restarts or thread terminations correlated with inbound HTTP traffic

Detection Strategies

Inspect web server and reverse proxy logs for query strings with high counts of [ and ] characters in a single parameter
Alert on Ruby exception telemetry referencing SystemStackError with Faraday frames in the stack trace
Correlate worker crash events with the source IP addresses sending matching query string patterns

Monitoring Recommendations

Track Faraday gem versions across the application inventory and flag installations below 1.10.6 or 2.14.3
Monitor worker pool saturation, restart frequency, and request latency for anomalies tied to query parameter parsing
Capture and retain full request URIs at the edge to support post-incident analysis of suspicious nesting patterns

How to Mitigate CVE-2026-54297

Immediate Actions Required

Upgrade Faraday to version 1.10.6 for the 1.x branch or 2.14.3 for the 2.x branch
Audit application code for paths that pass user-controlled query strings into Faraday URL builders or NestedParamsEncoder
Add web application firewall rules that reject query strings exceeding a reasonable bracket nesting depth

Patch Information

The maintainers released fixes in Faraday 1.10.6 and 2.14.3. Both releases enforce a maximum nesting depth in NestedParamsEncoder and the dehash routine. Update via bundle update faraday and verify the installed version with gem list faraday. Patch details are available in the Faraday GitHub Security Advisory GHSA-98m9-hrrm-r99r.

Workarounds

Replace Faraday::NestedParamsEncoder with Faraday::FlatParamsEncoder where nested parameters are not required
Validate and reject inbound query strings whose bracket depth exceeds an application-defined threshold before invoking Faraday
Wrap Faraday calls that process untrusted input in a rescue block that catches SystemStackError to prevent worker termination

bash

# Configuration example
bundle update faraday
gem list faraday
# Verify version is >= 1.10.6 or >= 2.14.3