Faraday's nested query parameter decoder can recursively walk an attacker‑controlled hash without a depth limit. When a crafted query string is passed to the encoder, Ruby ultimately throws an uncaught SystemStackError, terminating the thread or worker and causing the application to become unavailable. The flaw is a classic uncontrolled recursion issue identified as CWE‑674 and poses a pure denial‑of‑service risk with no direct impact on confidentiality or integrity.

The vulnerability affects the Faraday HTTP client library from the lostisland vendor. Versions from the initial release 1.0.0 up to but excluding 1.10.6, and similarly the 2.x series up to but excluding 2.14.3, are impacted. All later releases include the fix.

The CVSS score of 7.5 reflects a high severity potential for Denial of Service. The EPSS score is not available, so no quantitative exploitation likelihood can be claimed, and the CVE is not listed in the CISA KEV catalog. The flaw can be leveraged by an attacker who can govern the query string sent to an application using Faraday, making the risk most pronounced for API endpoints or services that forward user‑supplied URLs directly. The lack of depth control means anyone able to craft deep query parameters could induce a stack overflow, crash application threads, and disrupt service availability.