https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 23:55:33 +0000 https://vulnerability.circl.lu/vuln/ghsa-98m9-hrrm-r99r <p><strong>Affected:</strong> RubyGems: faraday</p> <p>`Faraday::NestedParamsEncoder`, the default nested query parameter encoder/decoder in Faraday, decodes nested query strings without enforcing a maximum nesting depth.</p> <p>A crafted query string such as:</p> <p>```text a[x][x][x][x]...[x]=1 ```</p> <p>causes Faraday to build a deeply nested Ruby `Hash` structure. The internal `dehash` routine then recursively walks this attacker-controlled structure without a depth limit. At sufficient depth, Ruby raises an uncaught `SystemStackError` (`stack level too deep`), crashing the calling thread or worker. This can lead to denial of service in applications that pass attacker-controlled query strings to Faraday&#39;s nested query parsing or URL-building paths.</p> <p>This has been patched in version 2.14.3 and backported to 1.10.6.</p> <p><strong>Affected:</strong> RubyGems: faraday</p> <p>`Faraday::NestedParamsEncoder`, the default nested query parameter encoder/decoder in Faraday, decodes nested query strings without enforcing a maximum nesting depth.</p> <p>A crafted query string such as:</p> <p>```text a[x][x][x][x]...[x]=1 ```</p> <p>causes Faraday to build a deeply nested Ruby `Hash` structure. The internal `dehash` routine then recursively walks this attacker-controlled structure without a depth limit. At sufficient depth, Ruby raises an uncaught `SystemStackError` (`stack level too deep`), crashing the calling thread or worker. This can lead to denial of service in applications that pass attacker-controlled query strings to Faraday&#39;s nested query parsing or URL-building paths.</p> <p>This has been patched in version 2.14.3 and backported to 1.10.6.</p> https://vulnerability.circl.lu/vuln/ghsa-98m9-hrrm-r99r