Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
lostisland faraday — Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U N N H 7.5 .0049 40.0 —
AFFECTED
Product Versions Fixed
faraday >= 1.0.0, < 1.10.6 – —
TIMELINE
Jun 12 Reserved by GitHub_M
Jun 24 EXPLOIT PUBLISHED — CVE-2026-54297 (lostisland faraday). Public exploit reference added.
Jun 24 Published (CNA: GitHub_M)
Aug 14 EXPLOIT PUBLISHED — CVE-2026-54297 (lostisland faraday). Public exploit reference added.
Description
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. From 1.0.0 until 1.10.6 and 2.14.3, Faraday::NestedParamsEncoder, the default nested query parameter encoder/decoder in Faraday, decodes nested query strings without enforcing a maximum nesting depth. A crafted query string causes Faraday to build a deeply nested Ruby Hash structure. The internal dehash routine then recursively walks this attacker-controlled structure without a depth limit. At sufficient depth, Ruby raises an uncaught SystemStackError (stack level too deep), crashing the calling thread or worker. This can lead to denial of service in applications that pass attacker-controlled query strings to Faraday's nested query parsing or URL-building paths. This vulnerability is fixed in 1.10.6 and 2.14.3.
Lifecycle
Complete event history — 4 events, chronological
| Date | Event | Detail |
|---|
| June 12, 2026 | Reserved | Reserved by GitHub_M |
| June 24, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-54297 (lostisland faraday). Public exploit reference added. |
| June 24, 2026 | Published | Published (CNA: GitHub_M) |
| August 14, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-54297 (lostisland faraday). Public exploit reference added. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| lostisland | faraday | — | >= 1.0.0, < 1.10.6 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-54297 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.