{
  "verdict": "confirmed",
  "cve": "CVE-2026-25765",
  "ghsa": "GHSA-33mh-2634-fwr2",
  "cwe": "CWE-918",
  "package": "faraday",
  "vulnerable_version": "2.14.0",
  "fixed_version": "2.14.1",
  "vulnerable_indicator": {
    "description": "Protocol-relative URL overrides base URL authority",
    "built_url": "http://127.0.0.1:<port>/x",
    "built_host": "127.0.0.1",
    "request_landed_on_listener": true,
    "listener_requests": 2,
    "request_success": true
  },
  "fixed_indicator": {
    "description": "Protocol-relative path no longer overrides base URL authority",
    "built_url": "http://192.0.2.1///127.0.0.1:<port>/x",
    "built_host": "192.0.2.1",
    "request_landed_on_listener": false,
    "listener_requests": 0,
    "request_success": false
  },
  "timestamp": "2025-05-22T17:51:17Z",
  "reproduction_method": "Local HTTP listener on 127.0.0.1 used as attacker host. Faraday connection configured with base URL http://192.0.2.1. Request path set to //127.0.0.1:<port>/x."
}