GHSA-c33f-42f2-gwcc

Medium

Published: —Translated: 23/09/2026(UTC)NVD NIST

Summary

The faraday-http-cache library acts as a shared cache by default (shared_cache: true). The ByUrl strategy keys entries on method and URL and treats a cached response without a Vary header as matching every request, while the ByVary strategy relies on the origin listing Authorization in Vary. A response to a request... (description truncated) may be improperly served to other users.

Risk Assessment

The shared cache can lead to cache poisoning, resulting in one user accessing responses intended for another, including credentials or confidential information.

Recommendation

Recommend disabling shared cache mode or ensuring proper Vary headers, especially for responses with Authorization, to prevent mixing data between users.

Other vulnerabilities in faraday-http-cache

GHSA-p8jg-8p9f-pgmrHigh
The faraday-http-cache library stores cached responses in JSON format by default and reads them back using JSON.load, which honors the json_class key and calls json_create on the named class. Response headers are stored verbatim in the cache entry, so a malicious origin server can return a response with a json_class key leading to unsafe deserialization.

Original NVD description (English source)

faraday-http-cache acts as a shared cache by default (shared_cache: true). The ByUrl strategy keys entries on method and URL and treats a cached response without a Vary header as matching every request, and the ByVary strategy relies on the origin listing Authorization in Vary. A response to a reque