Benoit Chesneau

HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney

SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney

CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney

Unbounded response body buffering and decompression in hackney

CR/LF injection in query parameter in hackney

Unbounded memory consumption in WebSocket client in hackney

Atom table exhaustion via unrecognized URL schemes in hackney

CRLF injection in WebSocket upgrade request in hackney

SSRF allowlist bypass via percent-encoded host in hackney

HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney