Skip to content

Commit c9205c0

Browse files
jasnowRubySec CI
jasnow
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@c4a5379 
1 parent d8cdc56 commit c9205c0

2 files changed

Lines changed: 147 additions & 0 deletions

File tree

‎advisories/_posts/2026-06-19-CVE-2026-54297.md‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-54297 (faraday): Faraday - Uncontrolled recursion in NestedParamsEncoder
4+
allows stack exhaustion DoS via deeply nested query parameters'
5+
comments: false
6+
categories:
7+
- faraday
8+
advisory:
9+
gem: faraday
10+
cve: 2026-54297
11+
ghsa: 98m9-hrrm-r99r
12+
url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54297
13+
title: Faraday - Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion
14+
DoS via deeply nested query parameters
15+
date: 2026-06-19
16+
description: |-
17+
# Uncontrolled Recursion in NestedParamsEncoder Allows Stack
18+
Exhaustion DoS via Deeply Nested Query Parameters
19+
20+
## Summary
21+
22+
`Faraday::NestedParamsEncoder`, the default nested query parameter
23+
encoder/decoder in Faraday, decodes nested query strings without
24+
enforcing a maximum nesting depth.
25+
26+
A crafted query string such as:
27+
28+
```text
29+
a[x][x][x][x]...[x]=1
30+
```
31+
32+
causes Faraday to build a deeply nested Ruby `Hash` structure. The
33+
internal `dehash` routine then recursively walks this attacker-controlled
34+
structure without a depth limit. At sufficient depth, Ruby raises an
35+
uncaught `SystemStackError` (`stack level too deep`), crashing the
36+
calling thread or worker.
37+
38+
This can lead to denial of service in applications that pass
39+
attacker-controlled query strings to Faraday's nested query parsing
40+
or URL-building paths.
41+
42+
## Impact
43+
44+
A relatively small query string can trigger a `SystemStackError` and
45+
crash the calling Ruby thread or worker.
46+
47+
In my local test environment, a payload of approximately 9.4 KB
48+
was sufficient:
49+
50+
```text
51+
depth=3119
52+
bytes=9360
53+
result=SystemStackError
54+
message="stack level too deep"
55+
```
56+
57+
Repeated requests with such payloads may cause a denial of service
58+
against applications whose request path forwards, parses, or rebuilds
59+
attacker-controlled query strings through Faraday.
60+
61+
This issue does not provide remote code execution, authentication
62+
bypass, or data disclosure. The confirmed impact is availability loss.
63+
64+
## Reporter
65+
66+
Reported by: Emre Koca
67+
cvss_v3: 7.5
68+
patched_versions:
69+
- ">= 2.14.3"
70+
related:
71+
url:
72+
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54297
73+
- https://rubygems.org/gems/faraday/versions/2.14.3
74+
- https://github.com/lostisland/faraday/releases/tag/v2.14.3
75+
- https://github.com/lostisland/faraday/compare/v2.14.2...v2.14.3
76+
- https://test.osv.dev/vulnerability/GHSA-98m9-hrrm-r99r
77+
- https://advisories.gitlab.com/gem/faraday/CVE-2026-54297
78+
- https://github.com/lostisland/faraday/security/advisories/GHSA-98m9-hrrm-r99r
79+
- https://github.com/advisories/GHSA-98m9-hrrm-r99r
80+
notes: |
81+
- cvss_v3 from GHSA
82+
- cve is reserved, but no cve at nvd.nist.gov, so no cvss_v2 or cvss_v4
83+
- Removed a lot of text from description field. See reference for details.
84+
---

‎advisories/_posts/2026-06-19-GHSA-mqq5-j7w8-2hgh.md‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-mqq5-j7w8-2hgh (alchemy_cms): AlchemyCMS - Unauthenticated nested page
4+
API leaks restricted and unpublished content'
5+
comments: false
6+
categories:
7+
- alchemy_cms
8+
advisory:
9+
gem: alchemy_cms
10+
ghsa: mqq5-j7w8-2hgh
11+
url: https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh
12+
title: AlchemyCMS - Unauthenticated nested page API leaks restricted and unpublished
13+
content
14+
date: 2026-06-19
15+
description: |-
16+
# Unauthenticated nested page API leaks restricted & unpublished content
17+
18+
- **Location:** `app/controllers/alchemy/api/pages_controller.rb:28`
19+
(`Api::PagesController#nested`)
20+
- **Affected version:** Alchemy CMS 8.3.0.dev (Rails 8.1.3)
21+
22+
## Description
23+
24+
The unauthenticated `GET /api/pages/nested` endpoint returns the full
25+
page tree to any anonymous caller, including restricted (member-only)
26+
pages and unpublished/draft pages that should be hidden.
27+
Appending `?elements=true` additionally dumps the element/ingredient
28+
**content** of restricted pages, fully bypassing the access control
29+
the sibling `show` and `index` actions enforce.
30+
31+
## Root cause
32+
33+
`Api::PagesController#nested` calls no `authorize!` and applies no
34+
`published`/`restricted` scoping, unlike `show` (`authorize! :show`)
35+
and `index` (`accessible_by(current_ability, :index)`).
36+
`PageTreePreloader` loads `page.self_and_descendants` unfiltered, and
37+
`PageTreeSerializer` emits every page's metadata (and, with `elements`,
38+
`public_version.elements`) with no ability check.
39+
cvss_v3: 7.5
40+
patched_versions:
41+
- "~> 7.4.15"
42+
- "~> 8.0.15"
43+
- "~> 8.1.14"
44+
- ">= 8.2.6"
45+
related:
46+
url:
47+
- https://rubygems.org/gems/alchemy_cms/versions/8.2.6
48+
- https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.2.6
49+
- https://github.com/AlchemyCMS/alchemy_cms/pull/3988
50+
- https://github.com/AlchemyCMS/alchemy_cms/pull/3982
51+
- https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.1.14
52+
- https://github.com/AlchemyCMS/alchemy_cms/pull/3987
53+
- https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.15
54+
- https://github.com/AlchemyCMS/alchemy_cms/pull/3984
55+
- https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.15
56+
- https://github.com/AlchemyCMS/alchemy_cms/pull/3983
57+
- https://advisories.gitlab.com/gem/alchemy_cms/GHSA-mqq5-j7w8-2hgh
58+
- https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh
59+
- https://github.com/advisories/GHSA-mqq5-j7w8-2hgh
60+
notes: |
61+
- cvss_v3 from GHSA
62+
- No cve value, so no cvss_v2 or cvss_v4 values
63+
---

0 commit comments

Comments
 (0)