---
id: 8493
title: "[CVE-2026-25765] How Neo found an SSRF vulnerability in Faraday, and why it matters for every team that ships code"
cve: CVE-2026-25765
source_domain: projectdiscovery.io
source_url: "https://projectdiscovery.io/blog/how-neo-found-an-ssrf-vulnerability-in-faraday-and-why-it-matters-for-every-team-that-ships-code"
published_at: "2026-03-03T17:05:32Z"
tags: ["ai-security", "bug-bounty", "supply-chain", "ruby", "vulnerability-discovery", "ssrf", "neo", "faraday", "cve-2026-25765"]
phying_url: "https://phying.com/item/8493"
lang: en
---

# [CVE-2026-25765] How Neo found an SSRF vulnerability in Faraday, and why it matters for every team that ships code

## Summary

Neo independently found an SSRF in Faraday, the popular Ruby HTTP client: a URL like //evil.com overrides the destination host. Tracked as CVE-2026-25765 (CVSS 5.8), fixed in Faraday 2.14.1.

## Intelligence Metadata

- **Sources:** projectdiscovery.io
- **CVE:** CVE-2026-25765
- **Published:** 2026-03-03T17:05:32Z
- **Original:** https://projectdiscovery.io/blog/how-neo-found-an-ssrf-vulnerability-in-faraday-and-why-it-matters-for-every-team-that-ships-code
- **Phying News:** https://phying.com/item/8493