CVE-2026-54297— lostisland Faraday 资源管理错误漏洞

Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters

Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. From 1.0.0 until 1.10.6 and 2.14.3, Faraday::NestedParamsEncoder, the default nested query parameter encoder/decoder in Faraday, decodes nested query strings without enforcing a maximum nesting depth. A crafted query string causes Faraday to build a deeply nested Ruby Hash structure. The internal dehash routine then recursively walks this attacker-controlled structure without a depth limit. At sufficient depth, Ruby raises an uncaught SystemStackError (stack level too deep), crashing the calling thread or worker. This can lead to denial of service in applications that pass attacker-controlled query strings to Faraday's nested query parsing or URL-building paths. This vulnerability is fixed in 1.10.6 and 2.14.3.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

未经控制的递归

lostisland Faraday 资源管理错误漏洞

lostisland faraday是lostisland团队的一个 HTTP 客户端库抽象层，通过统一的接口支持多种后端适配器（如 Net::HTTP），并引入 Rack 中间件模式处理请求/响应周期。 lostisland Faraday 1.0.0版本至1.10.6之前版本和2.0.0.alpha.pre.1版本至2.14.3之前版本存在资源管理错误漏洞，该漏洞源于Faraday::NestedParamsEncoder在解码嵌套查询字符串时未强制执行最大嵌套深度，可能导致拒绝服务。

N/A

N/A