Refine your search
18 vulnerabilities found for by benoitc
CVE-2026-97200 (GCVE-0-2026-97200)
Vulnerability from cvelistv5
Published
2026-10-26 13:49
Modified
2026-10-26 15:35
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds how much the connection process buffers. Any server the client requests can trigger it.
hackney_conn:read_full_body/2 and the HTTP/2 and HTTP/3 accumulators append every chunk until the body ends. With {auto_decompress, true} the buffered body is then inflated in one step with zlib:gunzip/1 or zlib:inflate/2, which return the whole output at once.
This issue affects hackney: from 2.0.0-beta.1 before 4.9.0.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-97200",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T14:54:57.385457Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T15:35:50.487Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_conn",
"hackney"
],
"packageName": "hackney",
"packageURL": "pkg:hex/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_conn.erl",
"src/hackney.erl"
],
"programRoutines": [
{
"name": "hackney_conn:read_full_body/2"
},
{
"name": "hackney_conn:maybe_decompress_body/2"
},
{
"name": "hackney_conn:decompress_gzip/1"
},
{
"name": "hackney_conn:decompress_deflate/1"
},
{
"name": "hackney:request/5"
},
{
"name": "hackney:body/1"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "4.9.0",
"status": "affected",
"version": "2.0.0-beta.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_conn",
"hackney"
],
"packageName": "benoitc/hackney",
"packageURL": "pkg:github/benoitc/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_conn.erl",
"src/hackney.erl"
],
"programRoutines": [
{
"name": "hackney_conn:read_full_body/2"
},
{
"name": "hackney_conn:maybe_decompress_body/2"
},
{
"name": "hackney_conn:decompress_gzip/1"
},
{
"name": "hackney_conn:decompress_deflate/1"
},
{
"name": "hackney:request/5"
},
{
"name": "hackney:body/1"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "493e8bf83a391548e5101792276ab3fc428fa76c",
"status": "affected",
"version": "dc41b79339ca0c41e16d3f2dd17172bc2de855d6",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.0",
"versionStartIncluding": "2.0.0-beta.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Martin Karrer"
},
{
"lang": "en",
"type": "finder",
"value": "Quinn Wilton"
},
{
"lang": "en",
"type": "reporter",
"value": "Quinn Wilton"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Martin Karrer"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Benoit Chesneau"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-10-26T09:42:31.000Z",
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in \u003ccode\u003ehackney_conn\u003c/code\u003e in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. \u003ccode\u003ehackney:request/5\u003c/code\u003e and \u003ccode\u003ehackney:body/1\u003c/code\u003e return the whole response body, and nothing bounds how much the connection process buffers. Any server the client requests can trigger it.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003ehackney_conn:read_full_body/2\u003c/code\u003e and the HTTP/2 and HTTP/3 accumulators append every chunk until the body ends. With \u003ccode\u003e{auto_decompress, true}\u003c/code\u003e the buffered body is then inflated in one step with \u003ccode\u003ezlib:gunzip/1\u003c/code\u003e or \u003ccode\u003ezlib:inflate/2\u003c/code\u003e, which return the whole output at once.\u003c/p\u003e\n\u003cp\u003eThis issue affects hackney: from 2.0.0-beta.1 before 4.9.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in `hackney_conn` in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. `hackney:request/5` and `hackney:body/1` return the whole response body, and nothing bounds how much the connection process buffers. Any server the client requests can trigger it.\n\n`hackney_conn:read_full_body/2` and the HTTP/2 and HTTP/3 accumulators append every chunk until the body ends. With `{auto_decompress, true}` the buffered body is then inflated in one step with `zlib:gunzip/1` or `zlib:inflate/2`, which return the whole output at once.\n\nThis issue affects hackney: from 2.0.0-beta.1 before 4.9.0."
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds how much the connection process buffers. Any server the client requests can trigger it.\n\nhackney_conn:read_full_body/2 and the HTTP/2 and HTTP/3 accumulators append every chunk until the body ends. With {auto_decompress, true} the buffered body is then inflated in one step with zlib:gunzip/1 or zlib:inflate/2, which return the whole output at once.\n\nThis issue affects hackney: from 2.0.0-beta.1 before 4.9.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA server the client requests can make the client allocate memory proportional to the body it sends, or to its decompressed size, until the node runs out of memory.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A server the client requests can make the client allocate memory proportional to the body it sends, or to its decompressed size, until the node runs out of memory."
}
],
"value": "A server the client requests can make the client allocate memory proportional to the body it sends, or to its decompressed size, until the node runs out of memory."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:49:40.392Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "hackney 4.9.0 release notes",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/benoitc/hackney/releases/tag/4.9.0"
},
{
"name": "EEF CNA record for CVE-2026-97200",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-97200.html"
},
{
"name": "OSV record EEF-CVE-2026-97200",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-97200"
},
{
"name": "Cap buffered response bodies with max_body_size and bound decompression (benoitc/hackney#980)",
"tags": [
"related"
],
"url": "https://github.com/benoitc/hackney/pull/980"
},
{
"name": "Introducing commit dc41b79 in benoitc/hackney",
"tags": [
"related"
],
"url": "https://github.com/benoitc/hackney/commit/dc41b79339ca0c41e16d3f2dd17172bc2de855d6"
},
{
"name": "Fix commit 493e8bf in benoitc/hackney",
"tags": [
"patch"
],
"url": "https://github.com/benoitc/hackney/commit/493e8bf83a391548e5101792276ab3fc428fa76c"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded response body buffering and decompression in hackney",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eLeave \u003ccode\u003eauto_decompress\u003c/code\u003e disabled (the default). Without it \u003ccode\u003ehackney_conn:maybe_decompress_body/2\u003c/code\u003e never inflates the body, which closes the amplification half. The uncapped raw body read has no workaround.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Leave `auto_decompress` disabled (the default). Without it `hackney_conn:maybe_decompress_body/2` never inflates the body, which closes the amplification half. The uncapped raw body read has no workaround."
}
],
"value": "Leave auto_decompress disabled (the default). Without it hackney_conn:maybe_decompress_body/2 never inflates the body, which closes the amplification half. The uncapped raw body read has no workaround."
}
],
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eBuild a gzip stream whose inflated size is 1 GB from a reused 64 KB chunk of zero bytes (deflate with window bits 31, best compression). The stream is about 1 MB on the wire.\u003c/li\u003e\n\u003cli\u003eStart a TCP listener on loopback that accepts one connection, reads the request, and answers \u003ccode\u003eHTTP/1.1 200 OK\u003c/code\u003e with \u003ccode\u003eContent-Encoding: gzip\u003c/code\u003e, a \u003ccode\u003eContent-Length\u003c/code\u003e matching the stream, \u003ccode\u003eConnection: close\u003c/code\u003e, and the stream as body.\u003c/li\u003e\n\u003cli\u003eFrom a node running a vulnerable hackney, call \u003ccode\u003ehackney:request(get, Url, [], \u0026lt;\u0026lt;\u0026gt;\u0026gt;, [{auto_decompress, true}, with_body])\u003c/code\u003e against that listener.\u003c/li\u003e\n\u003cli\u003eObserve the returned body of 1,048,576,000 bytes and the VM memory growing by about 1.8 GB for a 1,019,197 byte response. A larger stream, or an endless body without \u003ccode\u003eauto_decompress\u003c/code\u003e, drives the node out of memory.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Build a gzip stream whose inflated size is 1 GB from a reused 64 KB chunk of zero bytes (deflate with window bits 31, best compression). The stream is about 1 MB on the wire.\n2. Start a TCP listener on loopback that accepts one connection, reads the request, and answers `HTTP/1.1 200 OK` with `Content-Encoding: gzip`, a `Content-Length` matching the stream, `Connection: close`, and the stream as body.\n3. From a node running a vulnerable hackney, call `hackney:request(get, Url, [], \u003c\u003c\u003e\u003e, [{auto_decompress, true}, with_body])` against that listener.\n4. Observe the returned body of 1,048,576,000 bytes and the VM memory growing by about 1.8 GB for a 1,019,197 byte response. A larger stream, or an endless body without `auto_decompress`, drives the node out of memory."
}
],
"value": "* Build a gzip stream whose inflated size is 1 GB from a reused 64 KB chunk of zero bytes (deflate with window bits 31, best compression). The stream is about 1 MB on the wire.\n* Start a TCP listener on loopback that accepts one connection, reads the request, and answers HTTP/1.1 200 OK with Content-Encoding: gzip, a Content-Length matching the stream, Connection: close, and the stream as body.\n* From a node running a vulnerable hackney, call hackney:request(get, Url, [], \u003c\u003c\u003e\u003e, [{auto_decompress, true}, with_body]) against that listener.\n* Observe the returned body of 1,048,576,000 bytes and the VM memory growing by about 1.8 GB for a 1,019,197 byte response. A larger stream, or an endless body without auto_decompress, drives the node out of memory."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Unbounded accumulation.\u003c/strong\u003e \u003ccode\u003ehackney:request/5\u003c/code\u003e with a body, and \u003ccode\u003ehackney:body/1\u003c/code\u003e after \u003ccode\u003estart_response/1\u003c/code\u003e, read the response in \u003ccode\u003esrc/hackney_conn.erl\u003c/code\u003e through \u003ccode\u003eread_full_body/2\u003c/code\u003e, which appends each chunk to a binary accumulator until the body ends. The HTTP/2 and HTTP/3 synchronous paths accumulate stream data the same way. No option caps the size.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. One-step decompression.\u003c/strong\u003e With \u003ccode\u003e{auto_decompress, true}\u003c/code\u003e hackney sends \u003ccode\u003eAccept-Encoding: gzip, deflate\u003c/code\u003e. Once the body is complete, \u003ccode\u003emaybe_decompress_body/2\u003c/code\u003e dispatches on \u003ccode\u003eContent-Encoding\u003c/code\u003e to \u003ccode\u003edecompress_gzip/1\u003c/code\u003e (\u003ccode\u003ezlib:gunzip/1\u003c/code\u003e) or \u003ccode\u003edecompress_deflate/1\u003c/code\u003e (\u003ccode\u003ezlib:inflate/2\u003c/code\u003e). Both return the whole output at once, so the inflated size is bounded only by the compression ratio. The report measured a 1 MB gzip body inflating to 1 GB on hackney 4.8.4.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Unbounded accumulation.** `hackney:request/5` with a body, and `hackney:body/1` after `start_response/1`, read the response in `src/hackney_conn.erl` through `read_full_body/2`, which appends each chunk to a binary accumulator until the body ends. The HTTP/2 and HTTP/3 synchronous paths accumulate stream data the same way. No option caps the size.\n\n**2. One-step decompression.** With `{auto_decompress, true}` hackney sends `Accept-Encoding: gzip, deflate`. Once the body is complete, `maybe_decompress_body/2` dispatches on `Content-Encoding` to `decompress_gzip/1` (`zlib:gunzip/1`) or `decompress_deflate/1` (`zlib:inflate/2`). Both return the whole output at once, so the inflated size is bounded only by the compression ratio. The report measured a 1 MB gzip body inflating to 1 GB on hackney 4.8.4."
}
],
"value": "1. Unbounded accumulation. hackney:request/5 with a body, and hackney:body/1 after start_response/1, read the response in src/hackney_conn.erl through read_full_body/2, which appends each chunk to a binary accumulator until the body ends. The HTTP/2 and HTTP/3 synchronous paths accumulate stream data the same way. No option caps the size.\n\n2. One-step decompression. With {auto_decompress, true} hackney sends Accept-Encoding: gzip, deflate. Once the body is complete, maybe_decompress_body/2 dispatches on Content-Encoding to decompress_gzip/1 (zlib:gunzip/1) or decompress_deflate/1 (zlib:inflate/2). Both return the whole output at once, so the inflated size is bounded only by the compression ratio. The report measured a 1 MB gzip body inflating to 1 GB on hackney 4.8.4."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-97200",
"datePublished": "2026-10-26T13:49:40.392Z",
"dateReserved": "2026-10-26T05:15:01.465Z",
"dateUpdated": "2026-10-26T15:35:50.487Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115693 (GCVE-0-2026-115693)
Vulnerability from cvelistv5
Published
2026-10-26 13:49
Modified
2026-10-26 13:49
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-295 - Improper Certificate Validation
Summary
Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root.
The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname.
This issue affects hackney: from 1.24.0 before 4.9.0.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_ssl"
],
"packageName": "hackney",
"packageURL": "pkg:hex/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_ssl.erl"
],
"programRoutines": [
{
"name": "hackney_ssl:ssl_opts/2"
},
{
"name": "hackney_ssl:merge_ssl_opts/3"
},
{
"name": "hackney_ssl:partial_chain/1"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "4.9.0",
"status": "affected",
"version": "1.24.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_ssl"
],
"packageName": "benoitc/hackney",
"packageURL": "pkg:github/benoitc/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_ssl.erl"
],
"programRoutines": [
{
"name": "hackney_ssl:ssl_opts/2"
},
{
"name": "hackney_ssl:merge_ssl_opts/3"
},
{
"name": "hackney_ssl:partial_chain/1"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "915eb5737e9c489d8fc22eec8cdae30e9b027be4",
"status": "affected",
"version": "d8a9afcf5c3849904274e2eba1df56c63d1a1a0c",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe caller passes \u003ccode\u003ecacerts\u003c/code\u003e or \u003ccode\u003ecacertfile\u003c/code\u003e in \u003ccode\u003essl_options\u003c/code\u003e to restrict trust to a private CA, without a \u003ccode\u003epartial_chain\u003c/code\u003e of its own. Connections that use hackney\u0027s default certifi trust store are not affected.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The caller passes `cacerts` or `cacertfile` in `ssl_options` to restrict trust to a private CA, without a `partial_chain` of its own. Connections that use hackney\u0027s default certifi trust store are not affected."
}
],
"value": "The caller passes cacerts or cacertfile in ssl_options to restrict trust to a private CA, without a partial_chain of its own. Connections that use hackney\u0027s default certifi trust store are not affected."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.0",
"versionStartIncluding": "1.24.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Martin Karrer"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Martin Karrer"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-10-26T09:57:53.000Z",
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Certificate Validation vulnerability in \u003ccode\u003ehackney_ssl\u003c/code\u003e in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds \u003ccode\u003e{partial_chain, fun hackney_ssl:partial_chain/1}\u003c/code\u003e to every \u003ccode\u003everify_peer\u003c/code\u003e configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured \u003ccode\u003ecacerts\u003c/code\u003e. \u003ccode\u003ehackney_ssl:merge_ssl_opts/3\u003c/code\u003e kept the callback when the caller replaced the trust store with \u003ccode\u003ecacerts\u003c/code\u003e or \u003ccode\u003ecacertfile\u003c/code\u003e in \u003ccode\u003essl_options\u003c/code\u003e, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root.\u003c/p\u003e\n\u003cp\u003eThe hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname.\u003c/p\u003e\n\u003cp\u003eThis issue affects hackney: from 1.24.0 before 4.9.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Certificate Validation vulnerability in `hackney_ssl` in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds `{partial_chain, fun hackney_ssl:partial_chain/1}` to every `verify_peer` configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured `cacerts`. `hackney_ssl:merge_ssl_opts/3` kept the callback when the caller replaced the trust store with `cacerts` or `cacertfile` in `ssl_options`, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root.\n\nThe hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname.\n\nThis issue affects hackney: from 1.24.0 before 4.9.0."
}
],
"value": "Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root.\n\nThe hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname.\n\nThis issue affects hackney: from 1.24.0 before 4.9.0."
}
],
"impacts": [
{
"capecId": "CAPEC-94",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn attacker positioned between the client and a server pinned to a private CA, holding a publicly trusted certificate for the pinned hostname, can impersonate the server and read or modify the traffic the client sends and receives.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An attacker positioned between the client and a server pinned to a private CA, holding a publicly trusted certificate for the pinned hostname, can impersonate the server and read or modify the traffic the client sends and receives."
}
],
"value": "An attacker positioned between the client and a server pinned to a private CA, holding a publicly trusted certificate for the pinned hostname, can impersonate the server and read or modify the traffic the client sends and receives."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:49:29.374Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "Drop the certifi partial_chain when the caller pins cacerts or cacertfile (benoitc/hackney#978)",
"tags": [
"related"
],
"url": "https://github.com/benoitc/hackney/pull/978"
},
{
"name": "EEF CNA record for CVE-2026-115693",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-115693.html"
},
{
"name": "OSV record EEF-CVE-2026-115693",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-115693"
},
{
"name": "hackney 4.9.0 release notes",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/benoitc/hackney/releases/tag/4.9.0"
},
{
"name": "Introducing commit d8a9afc in benoitc/hackney",
"tags": [
"related"
],
"url": "https://github.com/benoitc/hackney/commit/d8a9afcf5c3849904274e2eba1df56c63d1a1a0c"
},
{
"name": "Fix commit 915eb57 in benoitc/hackney",
"tags": [
"patch"
],
"url": "https://github.com/benoitc/hackney/commit/915eb5737e9c489d8fc22eec8cdae30e9b027be4"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePass your own \u003ccode\u003e{partial_chain, Fun}\u003c/code\u003e in \u003ccode\u003essl_options\u003c/code\u003e alongside \u003ccode\u003ecacerts\u003c/code\u003e or \u003ccode\u003ecacertfile\u003c/code\u003e. A caller-supplied \u003ccode\u003epartial_chain\u003c/code\u003e replaces hackney\u0027s in the merge, and a callback that returns \u003ccode\u003eunknown_ca\u003c/code\u003e makes OTP validate against the configured \u003ccode\u003ecacerts\u003c/code\u003e only.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Pass your own `{partial_chain, Fun}` in `ssl_options` alongside `cacerts` or `cacertfile`. A caller-supplied `partial_chain` replaces hackney\u0027s in the merge, and a callback that returns `unknown_ca` makes OTP validate against the configured `cacerts` only."
}
],
"value": "Pass your own {partial_chain, Fun} in ssl_options alongside cacerts or cacertfile. A caller-supplied partial_chain replaces hackney\u0027s in the merge, and a callback that returns unknown_ca makes OTP validate against the configured cacerts only."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Default trust options.\u003c/strong\u003e \u003ccode\u003ehackney_ssl:check_hostname_opts/1\u003c/code\u003e builds the \u003ccode\u003everify_peer\u003c/code\u003e options for every TLS connection: the certifi \u003ccode\u003ecacerts\u003c/code\u003e, a hostname \u003ccode\u003everify_fun\u003c/code\u003e, and \u003ccode\u003e{partial_chain, fun hackney_ssl:partial_chain/1}\u003c/code\u003e. The callback walks the peer chain and returns \u003ccode\u003e{trusted_ca, Cert}\u003c/code\u003e for the first certificate whose public key matches a root in the bundled certifi store, which lets OTP accept chains that end in a cross-signed root.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Merge keeps the callback.\u003c/strong\u003e When the caller passes \u003ccode\u003essl_options\u003c/code\u003e, \u003ccode\u003ehackney_ssl:merge_ssl_opts/3\u003c/code\u003e merges them over the defaults with the caller\u0027s values winning per key. \u003ccode\u003ecacerts\u003c/code\u003e or \u003ccode\u003ecacertfile\u003c/code\u003e replace the trust store, and a \u003ccode\u003ecacertfile\u003c/code\u003e removes the default \u003ccode\u003ecacerts\u003c/code\u003e, but \u003ccode\u003epartial_chain\u003c/code\u003e has no counterpart in the caller\u0027s options and stays.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Validation.\u003c/strong\u003e OTP consults \u003ccode\u003epartial_chain\u003c/code\u003e before the configured trust store. A peer chain that carries any publicly trusted root therefore gets that root as its trust anchor, and the pinned \u003ccode\u003ecacerts\u003c/code\u003e are never consulted. Only the hostname \u003ccode\u003everify_fun\u003c/code\u003e still constrains the attacker.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Default trust options.** `hackney_ssl:check_hostname_opts/1` builds the `verify_peer` options for every TLS connection: the certifi `cacerts`, a hostname `verify_fun`, and `{partial_chain, fun hackney_ssl:partial_chain/1}`. The callback walks the peer chain and returns `{trusted_ca, Cert}` for the first certificate whose public key matches a root in the bundled certifi store, which lets OTP accept chains that end in a cross-signed root.\n\n**2. Merge keeps the callback.** When the caller passes `ssl_options`, `hackney_ssl:merge_ssl_opts/3` merges them over the defaults with the caller\u0027s values winning per key. `cacerts` or `cacertfile` replace the trust store, and a `cacertfile` removes the default `cacerts`, but `partial_chain` has no counterpart in the caller\u0027s options and stays.\n\n**3. Validation.** OTP consults `partial_chain` before the configured trust store. A peer chain that carries any publicly trusted root therefore gets that root as its trust anchor, and the pinned `cacerts` are never consulted. Only the hostname `verify_fun` still constrains the attacker."
}
],
"value": "1. Default trust options. hackney_ssl:check_hostname_opts/1 builds the verify_peer options for every TLS connection: the certifi cacerts, a hostname verify_fun, and {partial_chain, fun hackney_ssl:partial_chain/1}. The callback walks the peer chain and returns {trusted_ca, Cert} for the first certificate whose public key matches a root in the bundled certifi store, which lets OTP accept chains that end in a cross-signed root.\n\n2. Merge keeps the callback. When the caller passes ssl_options, hackney_ssl:merge_ssl_opts/3 merges them over the defaults with the caller\u0027s values winning per key. cacerts or cacertfile replace the trust store, and a cacertfile removes the default cacerts, but partial_chain has no counterpart in the caller\u0027s options and stays.\n\n3. Validation. OTP consults partial_chain before the configured trust store. A peer chain that carries any publicly trusted root therefore gets that root as its trust anchor, and the pinned cacerts are never consulted. Only the hostname verify_fun still constrains the attacker."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-115693",
"datePublished": "2026-10-26T13:49:29.374Z",
"dateReserved": "2026-10-25T10:45:02.327Z",
"dateUpdated": "2026-10-26T13:49:29.374Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113440 (GCVE-0-2026-113440)
Vulnerability from cvelistv5
Published
2026-10-26 13:49
Modified
2026-10-26 13:49
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-522 - Insufficiently Protected Credentials
Summary
Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged.
This issue affects hackney: from 2.0.0 before 4.9.0.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney"
],
"packageName": "hackney",
"packageURL": "pkg:hex/hackney",
"product": "hackney",
"programFiles": [
"src/hackney.erl"
],
"programRoutines": [
{
"name": "hackney:request/5"
},
{
"name": "hackney:follow_redirect/10"
},
{
"name": "hackney:maybe_strip_auth_on_redirect/3"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "4.9.0",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney"
],
"packageName": "benoitc/hackney",
"packageURL": "pkg:github/benoitc/hackney",
"product": "hackney",
"programFiles": [
"src/hackney.erl"
],
"programRoutines": [
{
"name": "hackney:request/5"
},
{
"name": "hackney:follow_redirect/10"
},
{
"name": "hackney:maybe_strip_auth_on_redirect/3"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "6548384b22ea196023a1963e2967d5715b6d9564",
"status": "affected",
"version": "8f944559bdb83da60b5c06f6cf6d842591278364",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe request is made with \u003ccode\u003efollow_redirect\u003c/code\u003e enabled and the \u003ccode\u003ebasic_auth\u003c/code\u003e or \u003ccode\u003ecookie\u003c/code\u003e option set, over HTTP/1.1 or HTTP/2, without \u003ccode\u003elocation_trusted\u003c/code\u003e. Credentials passed as explicit request headers are not forwarded on redirects and are not affected.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The request is made with `follow_redirect` enabled and the `basic_auth` or `cookie` option set, over HTTP/1.1 or HTTP/2, without `location_trusted`. Credentials passed as explicit request headers are not forwarded on redirects and are not affected."
}
],
"value": "The request is made with follow_redirect enabled and the basic_auth or cookie option set, over HTTP/1.1 or HTTP/2, without location_trusted. Credentials passed as explicit request headers are not forwarded on redirects and are not affected."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.0",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Martin Karrer"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Martin Karrer"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Benoit Chesneau"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-10-26T10:04:03.000Z",
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInsufficiently Protected Credentials vulnerability in \u003ccode\u003ehackney\u003c/code\u003e in benoitc hackney allows a redirecting server to obtain the \u003ccode\u003ebasic_auth\u003c/code\u003e and \u003ccode\u003ecookie\u003c/code\u003e credentials of a request via a same-host redirect to another scheme or port. With \u003ccode\u003efollow_redirect\u003c/code\u003e enabled, \u003ccode\u003ehackney:follow_redirect/10\u003c/code\u003e in \u003ccode\u003esrc/hackney.erl\u003c/code\u003e reissues the request to the \u003ccode\u003eLocation\u003c/code\u003e target after \u003ccode\u003ehackney:maybe_strip_auth_on_redirect/3\u003c/code\u003e, which compared only the hostname of the current and the redirect URL. A redirect from \u003ccode\u003ehttps\u003c/code\u003e to \u003ccode\u003ehttp\u003c/code\u003e on the same host resent the \u003ccode\u003eAuthorization\u003c/code\u003e and \u003ccode\u003eCookie\u003c/code\u003e headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. \u003ccode\u003elocation_trusted\u003c/code\u003e forwards credentials to any target by design and is unchanged.\u003c/p\u003e\n\u003cp\u003eThis issue affects hackney: from 2.0.0 before 4.9.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Insufficiently Protected Credentials vulnerability in `hackney` in benoitc hackney allows a redirecting server to obtain the `basic_auth` and `cookie` credentials of a request via a same-host redirect to another scheme or port. With `follow_redirect` enabled, `hackney:follow_redirect/10` in `src/hackney.erl` reissues the request to the `Location` target after `hackney:maybe_strip_auth_on_redirect/3`, which compared only the hostname of the current and the redirect URL. A redirect from `https` to `http` on the same host resent the `Authorization` and `Cookie` headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. `location_trusted` forwards credentials to any target by design and is unchanged.\n\nThis issue affects hackney: from 2.0.0 before 4.9.0."
}
],
"value": "Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged.\n\nThis issue affects hackney: from 2.0.0 before 4.9.0."
}
],
"impacts": [
{
"capecId": "CAPEC-102",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA server that answers a credentialed request with a same-host redirect to plain HTTP exposes the client\u0027s \u003ccode\u003eAuthorization\u003c/code\u003e and \u003ccode\u003eCookie\u003c/code\u003e headers to anyone on the network path, and a redirect to another port delivers them to whatever service listens there. The captured values can be replayed against the original origin.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A server that answers a credentialed request with a same-host redirect to plain HTTP exposes the client\u0027s `Authorization` and `Cookie` headers to anyone on the network path, and a redirect to another port delivers them to whatever service listens there. The captured values can be replayed against the original origin."
}
],
"value": "A server that answers a credentialed request with a same-host redirect to plain HTTP exposes the client\u0027s Authorization and Cookie headers to anyone on the network path, and a redirect to another port delivers them to whatever service listens there. The captured values can be replayed against the original origin."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522 Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:49:17.377Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "Strip basic_auth and cookie on redirects that change scheme or port (benoitc/hackney#979)",
"tags": [
"related"
],
"url": "https://github.com/benoitc/hackney/pull/979"
},
{
"name": "EEF CNA record for CVE-2026-113440",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-113440.html"
},
{
"name": "OSV record EEF-CVE-2026-113440",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-113440"
},
{
"name": "hackney 4.9.0 release notes",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/benoitc/hackney/releases/tag/4.9.0"
},
{
"name": "Introducing commit 8f94455 in benoitc/hackney",
"tags": [
"related"
],
"url": "https://github.com/benoitc/hackney/commit/8f944559bdb83da60b5c06f6cf6d842591278364"
},
{
"name": "Fix commit 6548384 in benoitc/hackney",
"tags": [
"patch"
],
"url": "https://github.com/benoitc/hackney/commit/6548384b22ea196023a1963e2967d5715b6d9564"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDisable \u003ccode\u003efollow_redirect\u003c/code\u003e and handle the \u003ccode\u003eLocation\u003c/code\u003e header in the application, or pass the credentials as explicit \u003ccode\u003eAuthorization\u003c/code\u003e and \u003ccode\u003eCookie\u003c/code\u003e request headers instead of the \u003ccode\u003ebasic_auth\u003c/code\u003e and \u003ccode\u003ecookie\u003c/code\u003e options. \u003ccode\u003ehackney:follow_redirect/10\u003c/code\u003e issues the redirected request with an empty header list, so explicit headers reach the first server only.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Disable `follow_redirect` and handle the `Location` header in the application, or pass the credentials as explicit `Authorization` and `Cookie` request headers instead of the `basic_auth` and `cookie` options. `hackney:follow_redirect/10` issues the redirected request with an empty header list, so explicit headers reach the first server only."
}
],
"value": "Disable follow_redirect and handle the Location header in the application, or pass the credentials as explicit Authorization and Cookie request headers instead of the basic_auth and cookie options. hackney:follow_redirect/10 issues the redirected request with an empty header list, so explicit headers reach the first server only."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Redirect handling.\u003c/strong\u003e With \u003ccode\u003efollow_redirect\u003c/code\u003e set, \u003ccode\u003ehackney:request/5\u003c/code\u003e hands a 3xx response to \u003ccode\u003ehackney:follow_redirect/10\u003c/code\u003e in \u003ccode\u003esrc/hackney.erl\u003c/code\u003e, which resolves the \u003ccode\u003eLocation\u003c/code\u003e header against the current URL and calls \u003ccode\u003ehackney:request/5\u003c/code\u003e again with the caller\u0027s options and an empty header list. HTTP/1.1 and HTTP/2 share this path.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Host-only comparison.\u003c/strong\u003e Before the new request, \u003ccode\u003ehackney:maybe_strip_auth_on_redirect/3\u003c/code\u003e removes the \u003ccode\u003ebasic_auth\u003c/code\u003e and \u003ccode\u003ecookie\u003c/code\u003e options when the redirect leaves the current host, unless \u003ccode\u003elocation_trusted\u003c/code\u003e is set. It compared \u003ccode\u003e#hackney_url.host\u003c/code\u003e of the two URLs.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Consequence.\u003c/strong\u003e A redirect that keeps the hostname but changes the scheme or the port passes the check, so the new request carries the same \u003ccode\u003eAuthorization\u003c/code\u003e and \u003ccode\u003eCookie\u003c/code\u003e headers. From \u003ccode\u003ehttps\u003c/code\u003e to \u003ccode\u003ehttp\u003c/code\u003e they travel in cleartext; to another port they reach a different service on the same host.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Redirect handling.** With `follow_redirect` set, `hackney:request/5` hands a 3xx response to `hackney:follow_redirect/10` in `src/hackney.erl`, which resolves the `Location` header against the current URL and calls `hackney:request/5` again with the caller\u0027s options and an empty header list. HTTP/1.1 and HTTP/2 share this path.\n\n**2. Host-only comparison.** Before the new request, `hackney:maybe_strip_auth_on_redirect/3` removes the `basic_auth` and `cookie` options when the redirect leaves the current host, unless `location_trusted` is set. It compared `#hackney_url.host` of the two URLs.\n\n**3. Consequence.** A redirect that keeps the hostname but changes the scheme or the port passes the check, so the new request carries the same `Authorization` and `Cookie` headers. From `https` to `http` they travel in cleartext; to another port they reach a different service on the same host."
}
],
"value": "1. Redirect handling. With follow_redirect set, hackney:request/5 hands a 3xx response to hackney:follow_redirect/10 in src/hackney.erl, which resolves the Location header against the current URL and calls hackney:request/5 again with the caller\u0027s options and an empty header list. HTTP/1.1 and HTTP/2 share this path.\n\n2. Host-only comparison. Before the new request, hackney:maybe_strip_auth_on_redirect/3 removes the basic_auth and cookie options when the redirect leaves the current host, unless location_trusted is set. It compared #hackney_url.host of the two URLs.\n\n3. Consequence. A redirect that keeps the hostname but changes the scheme or the port passes the check, so the new request carries the same Authorization and Cookie headers. From https to http they travel in cleartext; to another port they reach a different service on the same host."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-113440",
"datePublished": "2026-10-26T13:49:17.377Z",
"dateReserved": "2026-10-26T10:00:02.149Z",
"dateUpdated": "2026-10-26T13:49:17.377Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115700 (GCVE-0-2026-115700)
Vulnerability from cvelistv5
Published
2026-10-26 13:49
Modified
2026-10-26 13:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D (decoding to [::ffff:127.0.0.1]) or 127.0.0.1. is not an IP address to a caller's allowlist built on uri_string:parse/1 and inet:parse_address/1, while hackney connects to the address it denotes. The same applies to a Location target when redirects are followed.
The IP-literal gate that hackney_url:normalize/2 applies to a percent-decoded host, added to close the percent-encoded IP bypass of CVE-2026-47076, passes the decoded value to inet_parse:address/1 as is. The connect path in hackney_happy:parse_address/1 drops a surrounding bracket pair, and the resolver ignores a trailing dot, so both forms pass the gate and still reach the literal address. Domain names with a trailing dot and unencoded IPv6 literals are not affected.
This issue affects hackney: from 4.0.1 before 4.9.0.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_url"
],
"packageName": "hackney",
"packageURL": "pkg:hex/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_url.erl"
],
"programRoutines": [
{
"name": "hackney_url:normalize/2"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "4.9.0",
"status": "affected",
"version": "4.0.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_url"
],
"packageName": "benoitc/hackney",
"packageURL": "pkg:github/benoitc/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_url.erl"
],
"programRoutines": [
{
"name": "hackney_url:normalize/2"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "f19561a0b422376348c91537e51377ab7325f4ee",
"status": "affected",
"version": "452620a92ec1da2e6b4862a049a2a4f04b42068f",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe application passes URLs that an untrusted party can influence to hackney and relies on its own host allowlist, built on \u003ccode\u003euri_string:parse/1\u003c/code\u003e or \u003ccode\u003einet:parse_address/1\u003c/code\u003e, to keep requests away from internal addresses.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The application passes URLs that an untrusted party can influence to hackney and relies on its own host allowlist, built on `uri_string:parse/1` or `inet:parse_address/1`, to keep requests away from internal addresses."
}
],
"value": "The application passes URLs that an untrusted party can influence to hackney and relies on its own host allowlist, built on uri_string:parse/1 or inet:parse_address/1, to keep requests away from internal addresses."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.0",
"versionStartIncluding": "4.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eurico Nicacio"
},
{
"lang": "en",
"type": "reporter",
"value": "Eurico Nicacio"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Benoit Chesneau"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-10-26T10:12:09.000Z",
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInterpretation Conflict vulnerability in \u003ccode\u003ehackney_url\u003c/code\u003e in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as \u003ccode\u003e%5B%3A%3Affff%3A127%2E0%2E0%2E1%5D\u003c/code\u003e (decoding to \u003ccode\u003e[::ffff:127.0.0.1]\u003c/code\u003e) or \u003ccode\u003e127.0.0.1.\u003c/code\u003e is not an IP address to a caller\u0027s allowlist built on \u003ccode\u003euri_string:parse/1\u003c/code\u003e and \u003ccode\u003einet:parse_address/1\u003c/code\u003e, while hackney connects to the address it denotes. The same applies to a \u003ccode\u003eLocation\u003c/code\u003e target when redirects are followed.\u003c/p\u003e\n\u003cp\u003eThe IP-literal gate that \u003ccode\u003ehackney_url:normalize/2\u003c/code\u003e applies to a percent-decoded host, added to close the percent-encoded IP bypass of CVE-2026-47076, passes the decoded value to \u003ccode\u003einet_parse:address/1\u003c/code\u003e as is. The connect path in \u003ccode\u003ehackney_happy:parse_address/1\u003c/code\u003e drops a surrounding bracket pair, and the resolver ignores a trailing dot, so both forms pass the gate and still reach the literal address. Domain names with a trailing dot and unencoded IPv6 literals are not affected.\u003c/p\u003e\n\u003cp\u003eThis issue affects hackney: from 4.0.1 before 4.9.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Interpretation Conflict vulnerability in `hackney_url` in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as `%5B%3A%3Affff%3A127%2E0%2E0%2E1%5D` (decoding to `[::ffff:127.0.0.1]`) or `127.0.0.1.` is not an IP address to a caller\u0027s allowlist built on `uri_string:parse/1` and `inet:parse_address/1`, while hackney connects to the address it denotes. The same applies to a `Location` target when redirects are followed.\n\nThe IP-literal gate that `hackney_url:normalize/2` applies to a percent-decoded host, added to close the percent-encoded IP bypass of CVE-2026-47076, passes the decoded value to `inet_parse:address/1` as is. The connect path in `hackney_happy:parse_address/1` drops a surrounding bracket pair, and the resolver ignores a trailing dot, so both forms pass the gate and still reach the literal address. Domain names with a trailing dot and unencoded IPv6 literals are not affected.\n\nThis issue affects hackney: from 4.0.1 before 4.9.0."
}
],
"value": "Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D (decoding to [::ffff:127.0.0.1]) or 127.0.0.1. is not an IP address to a caller\u0027s allowlist built on uri_string:parse/1 and inet:parse_address/1, while hackney connects to the address it denotes. The same applies to a Location target when redirects are followed.\n\nThe IP-literal gate that hackney_url:normalize/2 applies to a percent-decoded host, added to close the percent-encoded IP bypass of CVE-2026-47076, passes the decoded value to inet_parse:address/1 as is. The connect path in hackney_happy:parse_address/1 drops a surrounding bracket pair, and the resolver ignores a trailing dot, so both forms pass the gate and still reach the literal address. Domain names with a trailing dot and unencoded IPv6 literals are not affected.\n\nThis issue affects hackney: from 4.0.1 before 4.9.0."
}
],
"impacts": [
{
"capecId": "CAPEC-664",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn application that checks user-supplied URLs against an IP allowlist before handing them to hackney can be made to request loopback, link-local metadata and private-network addresses that the allowlist rejects when they are written plainly.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An application that checks user-supplied URLs against an IP allowlist before handing them to hackney can be made to request loopback, link-local metadata and private-network addresses that the allowlist rejects when they are written plainly."
}
],
"value": "An application that checks user-supplied URLs against an IP allowlist before handing them to hackney can be made to request loopback, link-local metadata and private-network addresses that the allowlist rejects when they are written plainly."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-436",
"description": "CWE-436 Interpretation Conflict",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:49:02.744Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "hackney 4.9.0 release notes",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/benoitc/hackney/releases/tag/4.9.0"
},
{
"name": "EEF CNA record for CVE-2026-115700",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-115700.html"
},
{
"name": "OSV record EEF-CVE-2026-115700",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-115700"
},
{
"name": "Refuse bracketed and trailing-dot IP literals in normalize/2 (benoitc/hackney#987)",
"tags": [
"related"
],
"url": "https://github.com/benoitc/hackney/pull/987"
},
{
"name": "Introducing commit 452620a in benoitc/hackney",
"tags": [
"related"
],
"url": "https://github.com/benoitc/hackney/commit/452620a92ec1da2e6b4862a049a2a4f04b42068f"
},
{
"name": "Fix commit f19561a in benoitc/hackney",
"tags": [
"patch"
],
"url": "https://github.com/benoitc/hackney/commit/f19561a0b422376348c91537e51377ab7325f4ee"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eRun the allowlist on the host that \u003ccode\u003ehackney_url:normalize/1\u003c/code\u003e returns for the parsed URL, and strip a surrounding bracket pair and a trailing dot from it before the IP check, so the check sees the same address the connect path uses.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Run the allowlist on the host that `hackney_url:normalize/1` returns for the parsed URL, and strip a surrounding bracket pair and a trailing dot from it before the IP check, so the check sees the same address the connect path uses."
}
],
"value": "Run the allowlist on the host that hackney_url:normalize/1 returns for the parsed URL, and strip a surrounding bracket pair and a trailing dot from it before the IP check, so the check sees the same address the connect path uses."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. The gate.\u003c/strong\u003e \u003ccode\u003ehackney_url:normalize/2\u003c/code\u003e in \u003ccode\u003esrc/hackney_url.erl\u003c/code\u003e percent-decodes a host that is not already an IP literal and raises \u003ccode\u003einvalid_url_host\u003c/code\u003e when \u003ccode\u003einet_parse:address/1\u003c/code\u003e accepts the decoded value. This closed the plain percent-encoded IP case.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. What the connect path accepts.\u003c/strong\u003e \u003ccode\u003ehackney_happy:parse_address/1\u003c/code\u003e removes a surrounding \u003ccode\u003e[...]\u003c/code\u003e pair before calling \u003ccode\u003einet:parse_address/1\u003c/code\u003e, and the resolver treats a trailing dot as the root label. Neither form is accepted by \u003ccode\u003einet_parse:address/1\u003c/code\u003e, so \u003ccode\u003e[::ffff:127.0.0.1]\u003c/code\u003e and \u003ccode\u003e127.0.0.1.\u003c/code\u003e pass the gate.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Result.\u003c/strong\u003e A percent-encoded bracketed IPv6 literal such as \u003ccode\u003e%5B%3A%3Affff%3A127%2E0%2E0%2E1%5D\u003c/code\u003e, or an IPv4 literal with a trailing dot, is not an IP address to a caller\u0027s check based on \u003ccode\u003euri_string:parse/1\u003c/code\u003e and \u003ccode\u003einet:parse_address/1\u003c/code\u003e, but hackney connects to the address it denotes. The same applies to a \u003ccode\u003eLocation\u003c/code\u003e target when redirects are followed. The fix strips one bracket pair and one trailing dot in \u003ccode\u003eip_candidate/1\u003c/code\u003e before the gate.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. The gate.** `hackney_url:normalize/2` in `src/hackney_url.erl` percent-decodes a host that is not already an IP literal and raises `invalid_url_host` when `inet_parse:address/1` accepts the decoded value. This closed the plain percent-encoded IP case.\n\n**2. What the connect path accepts.** `hackney_happy:parse_address/1` removes a surrounding `[...]` pair before calling `inet:parse_address/1`, and the resolver treats a trailing dot as the root label. Neither form is accepted by `inet_parse:address/1`, so `[::ffff:127.0.0.1]` and `127.0.0.1.` pass the gate.\n\n**3. Result.** A percent-encoded bracketed IPv6 literal such as `%5B%3A%3Affff%3A127%2E0%2E0%2E1%5D`, or an IPv4 literal with a trailing dot, is not an IP address to a caller\u0027s check based on `uri_string:parse/1` and `inet:parse_address/1`, but hackney connects to the address it denotes. The same applies to a `Location` target when redirects are followed. The fix strips one bracket pair and one trailing dot in `ip_candidate/1` before the gate."
}
],
"value": "1. The gate. hackney_url:normalize/2 in src/hackney_url.erl percent-decodes a host that is not already an IP literal and raises invalid_url_host when inet_parse:address/1 accepts the decoded value. This closed the plain percent-encoded IP case.\n\n2. What the connect path accepts. hackney_happy:parse_address/1 removes a surrounding [...] pair before calling inet:parse_address/1, and the resolver treats a trailing dot as the root label. Neither form is accepted by inet_parse:address/1, so [::ffff:127.0.0.1] and 127.0.0.1. pass the gate.\n\n3. Result. A percent-encoded bracketed IPv6 literal such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D, or an IPv4 literal with a trailing dot, is not an IP address to a caller\u0027s check based on uri_string:parse/1 and inet:parse_address/1, but hackney connects to the address it denotes. The same applies to a Location target when redirects are followed. The fix strips one bracket pair and one trailing dot in ip_candidate/1 before the gate."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-115700",
"datePublished": "2026-10-26T13:49:02.744Z",
"dateReserved": "2026-10-25T17:30:02.231Z",
"dateUpdated": "2026-10-26T13:49:02.744Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112880 (GCVE-0-2026-112880)
Vulnerability from cvelistv5
Published
2026-10-26 13:48
Modified
2026-10-26 15:35
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Summary
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback returns. After a 407 response from an HTTP CONNECT proxy, hackney_http_connect:handle_proxy_auth/11 calls the caller's proxy_auth_fun with the status code and the response headers and writes the returned binary into the Proxy-Authorization line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy.
The value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy's challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes.
This issue affects hackney: from 2.0.0 before 4.9.0.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112880",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T15:00:47.038622Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T15:35:50.632Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_http_connect"
],
"packageName": "hackney",
"packageURL": "pkg:hex/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_http_connect.erl"
],
"programRoutines": [
{
"name": "hackney_http_connect:connect/4"
},
{
"name": "hackney_http_connect:do_handshake_with_auth/9"
},
{
"name": "hackney_http_connect:handle_proxy_auth/11"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "4.9.0",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_http_connect"
],
"packageName": "benoitc/hackney",
"packageURL": "pkg:github/benoitc/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_http_connect.erl"
],
"programRoutines": [
{
"name": "hackney_http_connect:connect/4"
},
{
"name": "hackney_http_connect:do_handshake_with_auth/9"
},
{
"name": "hackney_http_connect:handle_proxy_auth/11"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "5ee7d7d19eba27e774667d472feb1e93a08af7f9",
"status": "affected",
"version": "5df5a74a2817d5b12880d217db33253ff1fae1b5",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe client connects through an HTTP CONNECT proxy with the \u003ccode\u003eproxy_auth_fun\u003c/code\u003e option set, and the callback builds its result from data an untrusted party can influence, such as the proxy\u0027s 407 challenge headers. Deployments without \u003ccode\u003eproxy_auth_fun\u003c/code\u003e, or whose callback returns a fixed credential, are not affected.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The client connects through an HTTP CONNECT proxy with the `proxy_auth_fun` option set, and the callback builds its result from data an untrusted party can influence, such as the proxy\u0027s 407 challenge headers. Deployments without `proxy_auth_fun`, or whose callback returns a fixed credential, are not affected."
}
],
"value": "The client connects through an HTTP CONNECT proxy with the proxy_auth_fun option set, and the callback builds its result from data an untrusted party can influence, such as the proxy\u0027s 407 challenge headers. Deployments without proxy_auth_fun, or whose callback returns a fixed credential, are not affected."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.0",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Coles"
},
{
"lang": "en",
"type": "reporter",
"value": "Daniel Coles"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Benoit Chesneau"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-10-26T10:18:44.000Z",
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in \u003ccode\u003ehackney_http_connect\u003c/code\u003e in benoitc hackney allows HTTP Request Splitting via the value a \u003ccode\u003eproxy_auth_fun\u003c/code\u003e callback returns. After a 407 response from an HTTP CONNECT proxy, \u003ccode\u003ehackney_http_connect:handle_proxy_auth/11\u003c/code\u003e calls the caller\u0027s \u003ccode\u003eproxy_auth_fun\u003c/code\u003e with the status code and the response headers and writes the returned binary into the \u003ccode\u003eProxy-Authorization\u003c/code\u003e line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy.\u003c/p\u003e\n\u003cp\u003eThe value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy\u0027s challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes.\u003c/p\u003e\n\u003cp\u003eThis issue affects hackney: from 2.0.0 before 4.9.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in `hackney_http_connect` in benoitc hackney allows HTTP Request Splitting via the value a `proxy_auth_fun` callback returns. After a 407 response from an HTTP CONNECT proxy, `hackney_http_connect:handle_proxy_auth/11` calls the caller\u0027s `proxy_auth_fun` with the status code and the response headers and writes the returned binary into the `Proxy-Authorization` line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy.\n\nThe value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy\u0027s challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes.\n\nThis issue affects hackney: from 2.0.0 before 4.9.0."
}
],
"value": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback returns. After a 407 response from an HTTP CONNECT proxy, hackney_http_connect:handle_proxy_auth/11 calls the caller\u0027s proxy_auth_fun with the status code and the response headers and writes the returned binary into the Proxy-Authorization line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy.\n\nThe value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy\u0027s challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes.\n\nThis issue affects hackney: from 2.0.0 before 4.9.0."
}
],
"impacts": [
{
"capecId": "CAPEC-105",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA party who controls what the application\u0027s \u003ccode\u003eproxy_auth_fun\u003c/code\u003e returns, for instance through the challenge headers of a proxy it can influence, can add header lines to the CONNECT request the client sends to its proxy.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A party who controls what the application\u0027s `proxy_auth_fun` returns, for instance through the challenge headers of a proxy it can influence, can add header lines to the CONNECT request the client sends to its proxy."
}
],
"value": "A party who controls what the application\u0027s proxy_auth_fun returns, for instance through the challenge headers of a proxy it can influence, can add header lines to the CONNECT request the client sends to its proxy."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-113",
"description": "CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:48:46.589Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "hackney 4.9.0 release notes",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/benoitc/hackney/releases/tag/4.9.0"
},
{
"name": "EEF CNA record for CVE-2026-112880",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-112880.html"
},
{
"name": "OSV record EEF-CVE-2026-112880",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-112880"
},
{
"name": "Refuse CR/LF/NUL in the proxy_auth_fun result (benoitc/hackney#989)",
"tags": [
"related"
],
"url": "https://github.com/benoitc/hackney/pull/989"
},
{
"name": "Introducing commit 5df5a74 in benoitc/hackney",
"tags": [
"related"
],
"url": "https://github.com/benoitc/hackney/commit/5df5a74a2817d5b12880d217db33253ff1fae1b5"
},
{
"name": "Fix commit 5ee7d7d in benoitc/hackney",
"tags": [
"patch"
],
"url": "https://github.com/benoitc/hackney/commit/5ee7d7d19eba27e774667d472feb1e93a08af7f9"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCheck the value your \u003ccode\u003eproxy_auth_fun\u003c/code\u003e is about to return for CR, LF and NUL bytes and return \u003ccode\u003e{error, Reason}\u003c/code\u003e instead when one is present. The callback runs in the application, so the check can be made there.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Check the value your `proxy_auth_fun` is about to return for CR, LF and NUL bytes and return `{error, Reason}` instead when one is present. The callback runs in the application, so the check can be made there."
}
],
"value": "Check the value your proxy_auth_fun is about to return for CR, LF and NUL bytes and return {error, Reason} instead when one is present. The callback runs in the application, so the check can be made there."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Challenge.\u003c/strong\u003e \u003ccode\u003ehackney_http_connect:do_handshake_with_auth/9\u003c/code\u003e in \u003ccode\u003esrc/hackney_http_connect.erl\u003c/code\u003e sends the CONNECT request to the proxy. When the proxy answers 407 and the \u003ccode\u003eproxy_auth_fun\u003c/code\u003e option is set, it hands the status code and the parsed response headers to \u003ccode\u003ehackney_http_connect:handle_proxy_auth/11\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Callback result.\u003c/strong\u003e \u003ccode\u003ehandle_proxy_auth/11\u003c/code\u003e calls the caller\u0027s \u003ccode\u003eproxy_auth_fun\u003c/code\u003e with those two values. On \u003ccode\u003e{ok, AuthHeader}\u003c/code\u003e it removes any existing \u003ccode\u003eProxy-Authorization\u003c/code\u003e header and appends the binary \u003ccode\u003e\u0026lt;\u0026lt;\"Proxy-Authorization: \", AuthHeader/binary\u0026gt;\u0026gt;\u003c/code\u003e to the header list, then retries the handshake with it.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Splitting.\u003c/strong\u003e The header list is joined with CRLF into the CONNECT request. A CR, LF or NUL byte inside \u003ccode\u003eAuthHeader\u003c/code\u003e therefore ends the \u003ccode\u003eProxy-Authorization\u003c/code\u003e line early and the rest is sent as further header lines. The target host and the request headers go through control-byte checks on this path; the callback result did not. The fix applies the same \u003ccode\u003ehas_ctl_bytes/1\u003c/code\u003e check to it and returns \u003ccode\u003e{error, {proxy_auth_error, invalid_header}}\u003c/code\u003e.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Challenge.** `hackney_http_connect:do_handshake_with_auth/9` in `src/hackney_http_connect.erl` sends the CONNECT request to the proxy. When the proxy answers 407 and the `proxy_auth_fun` option is set, it hands the status code and the parsed response headers to `hackney_http_connect:handle_proxy_auth/11`.\n\n**2. Callback result.** `handle_proxy_auth/11` calls the caller\u0027s `proxy_auth_fun` with those two values. On `{ok, AuthHeader}` it removes any existing `Proxy-Authorization` header and appends the binary `\u003c\u003c\"Proxy-Authorization: \", AuthHeader/binary\u003e\u003e` to the header list, then retries the handshake with it.\n\n**3. Splitting.** The header list is joined with CRLF into the CONNECT request. A CR, LF or NUL byte inside `AuthHeader` therefore ends the `Proxy-Authorization` line early and the rest is sent as further header lines. The target host and the request headers go through control-byte checks on this path; the callback result did not. The fix applies the same `has_ctl_bytes/1` check to it and returns `{error, {proxy_auth_error, invalid_header}}`."
}
],
"value": "1. Challenge. hackney_http_connect:do_handshake_with_auth/9 in src/hackney_http_connect.erl sends the CONNECT request to the proxy. When the proxy answers 407 and the proxy_auth_fun option is set, it hands the status code and the parsed response headers to hackney_http_connect:handle_proxy_auth/11.\n\n2. Callback result. handle_proxy_auth/11 calls the caller\u0027s proxy_auth_fun with those two values. On {ok, AuthHeader} it removes any existing Proxy-Authorization header and appends the binary \u003c\u003c\"Proxy-Authorization: \", AuthHeader/binary\u003e\u003e to the header list, then retries the handshake with it.\n\n3. Splitting. The header list is joined with CRLF into the CONNECT request. A CR, LF or NUL byte inside AuthHeader therefore ends the Proxy-Authorization line early and the rest is sent as further header lines. The target host and the request headers go through control-byte checks on this path; the callback result did not. The fix applies the same has_ctl_bytes/1 check to it and returns {error, {proxy_auth_error, invalid_header}}."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-112880",
"datePublished": "2026-10-26T13:48:46.589Z",
"dateReserved": "2026-10-26T10:15:01.166Z",
"dateUpdated": "2026-10-26T15:35:50.632Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49457 (GCVE-0-2026-49457)
Vulnerability from cvelistv5
Published
2026-08-14 18:27
Modified
2026-08-14 19:30
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
erlang_quic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificate, so `verify` was effectively a no-op on the client. A man-in-the-middle on the network path could present any certificate and impersonate any server, defeating the confidentiality and integrity of the connection. HTTP/3 uses the same client and was equally affected. Handshakes authenticated by a PSK (session resumption) are not affected, because the peer is authenticated by the PSK binder and no certificate is sent. This is fixed in 1.4.4. The client now verifies the CertificateVerify signature, validates the certificate chain against the trust store (`cacerts` option, the operating system store by default), and checks the hostname. Client `verify` now defaults to on; set `verify => false` to accept any certificate (for example a self-signed test server). No known workarounds are available before 1.4.4. `verify => true` had no effect, and inspecting the certificate after connecting does not help because without the signature check the peer is never proven to own the certificate it presents.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| benoitc | erlang_quic |
Version: < 1.4.4 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49457",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T19:29:49.865264Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T19:30:02.687Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "erlang_quic",
"vendor": "benoitc",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "erlang_quic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificate, so `verify` was effectively a no-op on the client. A man-in-the-middle on the network path could present any certificate and impersonate any server, defeating the confidentiality and integrity of the connection. HTTP/3 uses the same client and was equally affected. Handshakes authenticated by a PSK (session resumption) are not affected, because the peer is authenticated by the PSK binder and no certificate is sent. This is fixed in 1.4.4. The client now verifies the CertificateVerify signature, validates the certificate chain against the trust store (`cacerts` option, the operating system store by default), and checks the hostname. Client `verify` now defaults to on; set `verify =\u003e false` to accept any certificate (for example a self-signed test server). No known workarounds are available before 1.4.4. `verify =\u003e true` had no effect, and inspecting the certificate after connecting does not help because without the signature check the peer is never proven to own the certificate it presents."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295: Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-297",
"description": "CWE-297: Improper Validation of Certificate with Host Mismatch",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T18:27:20.523Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/benoitc/erlang_quic/security/advisories/GHSA-2r8v-p65x-3663",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/benoitc/erlang_quic/security/advisories/GHSA-2r8v-p65x-3663"
}
],
"source": {
"advisory": "GHSA-2r8v-p65x-3663",
"discovery": "UNKNOWN"
},
"title": "QUIC has Broken TLS verification"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49457",
"datePublished": "2026-08-14T18:27:20.523Z",
"dateReserved": "2026-05-30T02:43:33.107Z",
"dateUpdated": "2026-08-14T19:30:02.687Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47073 (GCVE-0-2026-47073)
Vulnerability from cvelistv5
Published
2026-05-25 14:00
Modified
2026-05-27 15:41
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-400 - Uncontrolled Resource Consumption
Summary
Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The WebSocket client in src/hackney_ws.erl imposes no upper bound on memory consumption in three code paths. First, read_handshake_response/3 accumulates received bytes into a growing buffer with no size cap; the per-receive timeout resets on every chunk, so a server that streams bytes without ever sending \r\n\r\n causes the buffer to grow until memory is exhausted. Second, parse_payload/9 and parse_active_payload/8 do not validate the declared frame payload length against any limit; because RFC 6455 allows payload lengths up to 2^63-1 bytes, a server that announces a very large frame and dribbles bytes causes the accumulation buffer to grow until OOM. Third, the frag_buffer field in #ws_data{} accumulates continuation frames indefinitely; a server that sends an endless stream of non-final (nofin) fragmented frames without ever sending a final (fin) frame grows frag_buffer without bound.
In all three cases the attacker only needs to control the WebSocket server the hackney client connects to, with no authentication or special client configuration required.
This issue affects hackney: from 2.0.0 before 4.0.1.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47073",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-26T15:44:41.043069Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T15:44:44.796Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-q8jg-fgj4-fphf"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_ws"
],
"packageName": "hackney",
"packageURL": "pkg:hex/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_ws.erl"
],
"programRoutines": [
{
"name": "hackney_ws:read_handshake_response/3"
},
{
"name": "hackney_ws:parse_payload/9"
},
{
"name": "hackney_ws:parse_active_payload/8"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "4.0.1",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_ws"
],
"packageName": "benoitc/hackney",
"packageURL": "pkg:github/benoitc/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_ws.erl"
],
"programRoutines": [
{
"name": "hackney_ws:read_handshake_response/3"
},
{
"name": "hackney_ws:parse_payload/9"
},
{
"name": "hackney_ws:parse_active_payload/8"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "ce0109e2970ace6e20ff29bae9d05c3ac22ec6dc",
"status": "affected",
"version": "690cecaf236fba49526da404a5bc889a24367a3e",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.1",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "AND"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Benoit Chesneau"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding.\u003cp\u003eThe WebSocket client in \u003ctt\u003esrc/hackney_ws.erl\u003c/tt\u003e imposes no upper bound on memory consumption in three code paths. First, \u003ctt\u003eread_handshake_response/3\u003c/tt\u003e accumulates received bytes into a growing buffer with no size cap; the per-receive timeout resets on every chunk, so a server that streams bytes without ever sending \u003ctt\u003e\\r\\n\\r\\n\u003c/tt\u003e causes the buffer to grow until memory is exhausted. Second, \u003ctt\u003eparse_payload/9\u003c/tt\u003e and \u003ctt\u003eparse_active_payload/8\u003c/tt\u003e do not validate the declared frame payload length against any limit; because RFC 6455 allows payload lengths up to 2\u207b\u00b9\u2013\u00b9 bytes, a server that announces a very large frame and dribbles bytes causes the accumulation buffer to grow until OOM. Third, the \u003ctt\u003efrag_buffer\u003c/tt\u003e field in \u003ctt\u003e#ws_data{}\u003c/tt\u003e accumulates continuation frames indefinitely; a server that sends an endless stream of non-final (\u003ctt\u003enofin\u003c/tt\u003e) fragmented frames without ever sending a final (\u003ctt\u003efin\u003c/tt\u003e) frame grows \u003ctt\u003efrag_buffer\u003c/tt\u003e without bound.\u003c/p\u003e\u003cp\u003eIn all three cases the attacker only needs to control the WebSocket server the hackney client connects to, with no authentication or special client configuration required.\u003c/p\u003e\u003cp\u003eThis issue affects hackney: from 2.0.0 before 4.0.1.\u003c/p\u003e"
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The WebSocket client in src/hackney_ws.erl imposes no upper bound on memory consumption in three code paths. First, read_handshake_response/3 accumulates received bytes into a growing buffer with no size cap; the per-receive timeout resets on every chunk, so a server that streams bytes without ever sending \\r\\n\\r\\n causes the buffer to grow until memory is exhausted. Second, parse_payload/9 and parse_active_payload/8 do not validate the declared frame payload length against any limit; because RFC 6455 allows payload lengths up to 2^63-1 bytes, a server that announces a very large frame and dribbles bytes causes the accumulation buffer to grow until OOM. Third, the frag_buffer field in #ws_data{} accumulates continuation frames indefinitely; a server that sends an endless stream of non-final (nofin) fragmented frames without ever sending a final (fin) frame grows frag_buffer without bound.\n\nIn all three cases the attacker only needs to control the WebSocket server the hackney client connects to, with no authentication or special client configuration required.\n\nThis issue affects hackney: from 2.0.0 before 4.0.1."
}
],
"impacts": [
{
"capecId": "CAPEC-125",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-125 Flooding"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T15:41:30.606Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-q8jg-fgj4-fphf"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-47073.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-47073"
},
{
"tags": [
"patch"
],
"url": "https://github.com/benoitc/hackney/commit/ce0109e2970ace6e20ff29bae9d05c3ac22ec6dc"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded memory consumption in WebSocket client in hackney",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-47073",
"datePublished": "2026-05-25T14:00:49.112Z",
"dateReserved": "2026-05-18T17:28:08.322Z",
"dateUpdated": "2026-05-27T15:41:30.606Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47067 (GCVE-0-2026-47067)
Vulnerability from cvelistv5
Published
2026-05-25 14:00
Modified
2026-05-27 15:41
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Summary
Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackney_url.erl converts every unrecognized URL scheme to a permanent BEAM atom via binary_to_atom/2. BEAM atoms are never garbage-collected and the atom table defaults to a hard limit of 1,048,576 entries. An attacker who can supply URLs with attacker-chosen scheme prefixes — directly as request targets, as configured webhook URLs, or via Location headers followed during redirects — can exhaust the atom table and crash the entire BEAM VM with system_limit.
This issue affects hackney: from 2.0.0 before 4.0.1.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47067",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-26T15:45:32.232194Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T15:45:36.464Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_url"
],
"packageName": "hackney",
"packageURL": "pkg:hex/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_url.erl"
],
"programRoutines": [
{
"name": "hackney_url:parse_url/1"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "4.0.1",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_url"
],
"packageName": "benoitc/hackney",
"packageURL": "pkg:github/benoitc/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_url.erl"
],
"programRoutines": [
{
"name": "hackney_url:parse_url/1"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "31f6f0e27e096ad88743dfded4f030a3ee74972e",
"status": "affected",
"version": "d9713695c0d99855d12c73fd8a0b4be0543950c4",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.1",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "AND"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Benoit Chesneau"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding.\u003cp\u003eThe URL parser in \u003ctt\u003esrc/hackney_url.erl\u003c/tt\u003e converts every unrecognized URL scheme to a permanent BEAM atom via \u003ctt\u003ebinary_to_atom/2\u003c/tt\u003e. BEAM atoms are never garbage-collected and the atom table defaults to a hard limit of 1,048,576 entries. An attacker who can supply URLs with attacker-chosen scheme prefixes \u2014 directly as request targets, as configured webhook URLs, or via \u003ctt\u003eLocation\u003c/tt\u003e headers followed during redirects \u2014 can exhaust the atom table and crash the entire BEAM VM with \u003ctt\u003esystem_limit\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects hackney: from 2.0.0 before 4.0.1.\u003c/p\u003e"
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackney_url.erl converts every unrecognized URL scheme to a permanent BEAM atom via binary_to_atom/2. BEAM atoms are never garbage-collected and the atom table defaults to a hard limit of 1,048,576 entries. An attacker who can supply URLs with attacker-chosen scheme prefixes \u2014 directly as request targets, as configured webhook URLs, or via Location headers followed during redirects \u2014 can exhaust the atom table and crash the entire BEAM VM with system_limit.\n\nThis issue affects hackney: from 2.0.0 before 4.0.1."
}
],
"impacts": [
{
"capecId": "CAPEC-125",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-125 Flooding"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T15:41:27.821Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-47067.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-47067"
},
{
"tags": [
"patch"
],
"url": "https://github.com/benoitc/hackney/commit/31f6f0e27e096ad88743dfded4f030a3ee74972e"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Atom table exhaustion via unrecognized URL schemes in hackney",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-47067",
"datePublished": "2026-05-25T14:00:48.507Z",
"dateReserved": "2026-05-18T17:28:08.321Z",
"dateUpdated": "2026-05-27T15:41:27.821Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47072 (GCVE-0-2026-47072)
Vulnerability from cvelistv5
Published
2026-05-25 14:00
Modified
2026-05-27 15:41
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Summary
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Request/Response Splitting. The WebSocket upgrade code in src/hackney_ws.erl copies the host, path, headers (ExtraHeaders), and protocols options from the caller-supplied opts map into the internal #ws_data{} record in init/1 and then splices them verbatim into the raw HTTP/1.1 upgrade request by binary concatenation in do_handshake/1. No CRLF or NUL stripping is performed at any of these four injection sites. An attacker who controls any of these options — for example by forwarding URL components or header values from untrusted input into hackney_ws:start_link/1 — can inject arbitrary HTTP headers into the outbound WebSocket upgrade request, leading to header injection, credential spoofing toward the upstream server, log and cache poisoning, or request smuggling via intermediary proxies.
This issue affects hackney: from 2.0.0 before 4.0.1.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47072",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-26T15:46:12.092004Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T15:46:14.885Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-f9vr-g2g2-x9fg"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_ws"
],
"packageName": "hackney",
"packageURL": "pkg:hex/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_ws.erl"
],
"programRoutines": [
{
"name": "hackney_ws:do_handshake/1"
},
{
"name": "hackney_ws:init/1"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "4.0.1",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_ws"
],
"packageName": "benoitc/hackney",
"packageURL": "pkg:github/benoitc/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_ws.erl"
],
"programRoutines": [
{
"name": "hackney_ws:do_handshake/1"
},
{
"name": "hackney_ws:init/1"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "52310ca807e7b48441ba0e9129171f535313fdd1",
"status": "affected",
"version": "690cecaf236fba49526da404a5bc889a24367a3e",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.1",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "AND"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Benoit Chesneau"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027) vulnerability in benoitc hackney allows HTTP Request/Response Splitting.\u003cp\u003eThe WebSocket upgrade code in \u003ctt\u003esrc/hackney_ws.erl\u003c/tt\u003e copies the \u003ctt\u003ehost\u003c/tt\u003e, \u003ctt\u003epath\u003c/tt\u003e, \u003ctt\u003eheaders\u003c/tt\u003e (ExtraHeaders), and \u003ctt\u003eprotocols\u003c/tt\u003e options from the caller-supplied opts map into the internal \u003ctt\u003e#ws_data{}\u003c/tt\u003e record in \u003ctt\u003einit/1\u003c/tt\u003e and then splices them verbatim into the raw HTTP/1.1 upgrade request by binary concatenation in \u003ctt\u003edo_handshake/1\u003c/tt\u003e. No CRLF or NUL stripping is performed at any of these four injection sites. An attacker who controls any of these options \u2014 for example by forwarding URL components or header values from untrusted input into \u003ctt\u003ehackney_ws:start_link/1\u003c/tt\u003e \u2014 can inject arbitrary HTTP headers into the outbound WebSocket upgrade request, leading to header injection, credential spoofing toward the upstream server, log and cache poisoning, or request smuggling via intermediary proxies.\u003c/p\u003e\u003cp\u003eThis issue affects hackney: from 2.0.0 before 4.0.1.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027) vulnerability in benoitc hackney allows HTTP Request/Response Splitting. The WebSocket upgrade code in src/hackney_ws.erl copies the host, path, headers (ExtraHeaders), and protocols options from the caller-supplied opts map into the internal #ws_data{} record in init/1 and then splices them verbatim into the raw HTTP/1.1 upgrade request by binary concatenation in do_handshake/1. No CRLF or NUL stripping is performed at any of these four injection sites. An attacker who controls any of these options \u2014 for example by forwarding URL components or header values from untrusted input into hackney_ws:start_link/1 \u2014 can inject arbitrary HTTP headers into the outbound WebSocket upgrade request, leading to header injection, credential spoofing toward the upstream server, log and cache poisoning, or request smuggling via intermediary proxies.\n\nThis issue affects hackney: from 2.0.0 before 4.0.1."
}
],
"impacts": [
{
"capecId": "CAPEC-33",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-33 HTTP Request Smuggling"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93 Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T15:41:24.863Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-f9vr-g2g2-x9fg"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-47072.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-47072"
},
{
"tags": [
"patch"
],
"url": "https://github.com/benoitc/hackney/commit/52310ca807e7b48441ba0e9129171f535313fdd1"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CRLF injection in WebSocket upgrade request in hackney",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-47072",
"datePublished": "2026-05-25T14:00:47.852Z",
"dateReserved": "2026-05-18T17:28:08.322Z",
"dateUpdated": "2026-05-27T15:41:24.863Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47076 (GCVE-0-2026-47076)
Vulnerability from cvelistv5
Published
2026-05-25 14:00
Modified
2026-05-27 15:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Interpretation Conflict vulnerability in benoitc hackney allows Server Side Request Forgery. hackney_url:normalize/2 URL-decodes the host component after the URL has been parsed into a #hackney_url{} record. OTP's uri_string:parse/1 and inet:parse_address/1 do not decode percent-escapes in the host, so a URL such as http://%31%32%37%2E%30%2E%30%2E%31/ is seen by a caller's allowlist validator with host %31%32%37%2E%30%2E%30%2E%31 (not an IP address), which passes the allowlist check. hackney's normalizer then decodes the host to 127.0.0.1 and opens a TCP connection to loopback. Because hackney:request/5 always calls hackney_url:normalize/2 with no opt-out, every request that takes a binary or list URL is affected. The same technique reaches cloud instance metadata services (169.254.169.254), RFC1918 networks, and any admin interface listening on localhost.
This issue affects hackney: from 0.13.0 before 4.0.1.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47076",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-26T15:46:49.956392Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T15:46:52.424Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-pj7v-xfvx-wmjq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_url"
],
"packageName": "hackney",
"packageURL": "pkg:hex/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_url.erl"
],
"programRoutines": [
{
"name": "hackney_url:normalize/2"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "4.0.1",
"status": "affected",
"version": "0.13.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_url"
],
"packageName": "benoitc/hackney",
"packageURL": "pkg:github/benoitc/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_url.erl"
],
"programRoutines": [
{
"name": "hackney_url:normalize/2"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "452620a92ec1da2e6b4862a049a2a4f04b42068f",
"status": "affected",
"version": "4d725507588942fd00efca15b86da3273656510a",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.1",
"versionStartIncluding": "0.13.0",
"vulnerable": true
}
],
"negate": false,
"operator": "AND"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ganbagana"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Benoit Chesneau"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Interpretation Conflict vulnerability in benoitc hackney allows Server Side Request Forgery.\u003cp\u003e\u003ctt\u003ehackney_url:normalize/2\u003c/tt\u003e URL-decodes the host component after the URL has been parsed into a \u003ctt\u003e#hackney_url{}\u003c/tt\u003e record. OTP\u0027s \u003ctt\u003euri_string:parse/1\u003c/tt\u003e and \u003ctt\u003einet:parse_address/1\u003c/tt\u003e do not decode percent-escapes in the host, so a URL such as \u003ctt\u003ehttp://%31%32%37%2E%30%2E%30%2E%31/\u003c/tt\u003e is seen by a caller\u0027s allowlist validator with host \u003ctt\u003e%31%32%37%2E%30%2E%30%2E%31\u003c/tt\u003e (not an IP address), which passes the allowlist check. hackney\u0027s normalizer then decodes the host to \u003ctt\u003e127.0.0.1\u003c/tt\u003e and opens a TCP connection to loopback. Because \u003ctt\u003ehackney:request/5\u003c/tt\u003e always calls \u003ctt\u003ehackney_url:normalize/2\u003c/tt\u003e with no opt-out, every request that takes a binary or list URL is affected. The same technique reaches cloud instance metadata services (169.254.169.254), RFC1918 networks, and any admin interface listening on localhost.\u003c/p\u003e\u003cp\u003eThis issue affects hackney: from 0.13.0 before 4.0.1.\u003c/p\u003e"
}
],
"value": "Interpretation Conflict vulnerability in benoitc hackney allows Server Side Request Forgery. hackney_url:normalize/2 URL-decodes the host component after the URL has been parsed into a #hackney_url{} record. OTP\u0027s uri_string:parse/1 and inet:parse_address/1 do not decode percent-escapes in the host, so a URL such as http://%31%32%37%2E%30%2E%30%2E%31/ is seen by a caller\u0027s allowlist validator with host %31%32%37%2E%30%2E%30%2E%31 (not an IP address), which passes the allowlist check. hackney\u0027s normalizer then decodes the host to 127.0.0.1 and opens a TCP connection to loopback. Because hackney:request/5 always calls hackney_url:normalize/2 with no opt-out, every request that takes a binary or list URL is affected. The same technique reaches cloud instance metadata services (169.254.169.254), RFC1918 networks, and any admin interface listening on localhost.\n\nThis issue affects hackney: from 0.13.0 before 4.0.1."
}
],
"impacts": [
{
"capecId": "CAPEC-664",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-664 Server Side Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-436",
"description": "CWE-436 Interpretation Conflict",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T15:41:17.845Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-pj7v-xfvx-wmjq"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-47076.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-47076"
},
{
"tags": [
"patch"
],
"url": "https://github.com/benoitc/hackney/commit/452620a92ec1da2e6b4862a049a2a4f04b42068f"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "SSRF allowlist bypass via percent-encoded host in hackney",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-47076",
"datePublished": "2026-05-25T14:00:46.707Z",
"dateReserved": "2026-05-18T17:28:10.319Z",
"dateUpdated": "2026-05-27T15:41:17.845Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47070 (GCVE-0-2026-47070)
Vulnerability from cvelistv5
Published
2026-05-25 14:00
Modified
2026-05-27 15:41
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Summary
Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackney_h3.erl passes the original request headers unchanged to the redirect target without performing any cross-origin check. When a client issues an HTTP/3 request with follow_redirect enabled and includes Authorization or Cookie headers, a server responding with a 3xx redirect to a different host will cause the client to forward those credentials verbatim to the new origin.
The main hackney.erl module has maybe_strip_auth_on_redirect/2 (guarded by the location_trusted option) to address CVE-2018-1000007, but hackney_h3.erl is missing this protection entirely.
This issue affects hackney: from 3.1.1 before 4.0.1.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47070",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-26T15:47:18.083809Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T15:47:21.139Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-h73q-4w9q-82h4"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_h3"
],
"packageName": "hackney",
"packageURL": "pkg:hex/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_h3.erl"
],
"programRoutines": [
{
"name": "hackney_h3:handle_redirect/11"
},
{
"name": "hackney_h3:do_request_with_redirect/8"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "4.0.1",
"status": "affected",
"version": "3.1.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_h3"
],
"packageName": "benoitc/hackney",
"packageURL": "pkg:github/benoitc/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_h3.erl"
],
"programRoutines": [
{
"name": "hackney_h3:handle_redirect/11"
},
{
"name": "hackney_h3:do_request_with_redirect/8"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "c58d5b50bade146360b85caf3dc8065807b08246",
"status": "affected",
"version": "e61b7d04b7826847e1efe614106ef4d580c78eab",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.1",
"versionStartIncluding": "3.1.1",
"vulnerable": true
}
],
"negate": false,
"operator": "AND"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Benoit Chesneau"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data.\u003cp\u003eThe HTTP/3 redirect handler in \u003ctt\u003esrc/hackney_h3.erl\u003c/tt\u003e passes the original request headers unchanged to the redirect target without performing any cross-origin check. When a client issues an HTTP/3 request with \u003ctt\u003efollow_redirect\u003c/tt\u003e enabled and includes \u003ctt\u003eAuthorization\u003c/tt\u003e or \u003ctt\u003eCookie\u003c/tt\u003e headers, a server responding with a \u003ctt\u003e3xx\u003c/tt\u003e redirect to a different host will cause the client to forward those credentials verbatim to the new origin.\u003c/p\u003e\u003cp\u003eThe main \u003ctt\u003ehackney.erl\u003c/tt\u003e module has \u003ctt\u003emaybe_strip_auth_on_redirect/2\u003c/tt\u003e (guarded by the \u003ctt\u003elocation_trusted\u003c/tt\u003e option) to address CVE-2018-1000007, but \u003ctt\u003ehackney_h3.erl\u003c/tt\u003e is missing this protection entirely.\u003c/p\u003e\u003cp\u003eThis issue affects hackney: from 3.1.1 before 4.0.1.\u003c/p\u003e"
}
],
"value": "Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackney_h3.erl passes the original request headers unchanged to the redirect target without performing any cross-origin check. When a client issues an HTTP/3 request with follow_redirect enabled and includes Authorization or Cookie headers, a server responding with a 3xx redirect to a different host will cause the client to forward those credentials verbatim to the new origin.\n\nThe main hackney.erl module has maybe_strip_auth_on_redirect/2 (guarded by the location_trusted option) to address CVE-2018-1000007, but hackney_h3.erl is missing this protection entirely.\n\nThis issue affects hackney: from 3.1.1 before 4.0.1."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T15:41:16.046Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-h73q-4w9q-82h4"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-47070.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-47070"
},
{
"tags": [
"patch"
],
"url": "https://github.com/benoitc/hackney/commit/c58d5b50bade146360b85caf3dc8065807b08246"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-47070",
"datePublished": "2026-05-25T14:00:46.420Z",
"dateReserved": "2026-05-18T17:28:08.322Z",
"dateUpdated": "2026-05-27T15:41:16.046Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47075 (GCVE-0-2026-47075)
Vulnerability from cvelistv5
Published
2026-05-25 14:00
Modified
2026-07-24 14:15
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Summary
Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r) or line feed (\n) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar defined in RFC 3986 Section 3.4 must be percent-encoded, but hackney_url:make_url/3 passes the query binary directly without validation or escaping. An attacker who can control all or part of a URL passed to hackney can inject raw CRLF sequences into the query string, which are then sent as HTTP line breaks in the request target. This enables injection of arbitrary HTTP headers or splitting of the HTTP request.
This issue affects hackney: from 0.13.1 before 4.0.1.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47075",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-26T15:50:04.477395Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T15:50:09.349Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_url"
],
"packageName": "hackney",
"packageURL": "pkg:hex/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_url.erl"
],
"programRoutines": [
{
"name": "hackney_url:make_url/3"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "4.0.1",
"status": "affected",
"version": "0.13.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_url"
],
"packageName": "benoitc/hackney",
"packageURL": "pkg:github/benoitc/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_url.erl"
],
"programRoutines": [
{
"name": "hackney_url:make_url/3"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "ca73dd0aba0ed557449c18288bf07241671a43c9",
"status": "affected",
"version": "8bb1a359a81ae58567c84f8d24564e9742e6f2bd",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.1",
"versionStartIncluding": "0.13.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "tepel-chen"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Benoit Chesneau"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting.\u003cp\u003ehackney does not percent-encode carriage return (\u003ctt\u003e\\r\u003c/tt\u003e) or line feed (\u003ctt\u003e\\n\u003c/tt\u003e) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar defined in RFC 3986 Section 3.4 must be percent-encoded, but \u003ctt\u003ehackney_url:make_url/3\u003c/tt\u003e passes the query binary directly without validation or escaping. An attacker who can control all or part of a URL passed to hackney can inject raw CRLF sequences into the query string, which are then sent as HTTP line breaks in the request target. This enables injection of arbitrary HTTP headers or splitting of the HTTP request.\u003c/p\u003e\u003cp\u003eThis issue affects hackney: from 0.13.1 before 4.0.1.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\\r) or line feed (\\n) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar defined in RFC 3986 Section 3.4 must be percent-encoded, but hackney_url:make_url/3 passes the query binary directly without validation or escaping. An attacker who can control all or part of a URL passed to hackney can inject raw CRLF sequences into the query string, which are then sent as HTTP line breaks in the request target. This enables injection of arbitrary HTTP headers or splitting of the HTTP request.\n\nThis issue affects hackney: from 0.13.1 before 4.0.1."
}
],
"impacts": [
{
"capecId": "CAPEC-105",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-105 HTTP Request Splitting"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93 Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:15:24.720Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-47075.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-47075"
},
{
"tags": [
"patch"
],
"url": "https://github.com/benoitc/hackney/commit/ca73dd0aba0ed557449c18288bf07241671a43c9"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CR/LF injection in query parameter in hackney",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-47075",
"datePublished": "2026-05-25T14:00:45.781Z",
"dateReserved": "2026-05-18T17:28:08.322Z",
"dateUpdated": "2026-07-24T14:15:24.720Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47077 (GCVE-0-2026-47077)
Vulnerability from cvelistv5
Published
2026-05-25 14:00
Modified
2026-05-27 15:40
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-400 - Uncontrolled Resource Consumption
Summary
Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. hackney_h3:await_response_loop/6 accumulates the HTTP/3 response body in memory without any size cap. The after Timeout clause is a per-message inactivity timer that resets on every received chunk, housekeeping message, or settings frame — it is not a wall-clock deadline. A malicious HTTP/3 server that emits one small chunk every Timeout - 1 ms with Fin = false and never sends a final frame keeps the loop alive indefinitely while the accumulation buffer grows linearly without bound, eventually exhausting the BEAM process heap and causing an out-of-memory condition.
This issue affects hackney: from 2.0.0 before 4.0.1.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47077",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-26T15:47:51.427632Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T15:47:54.752Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-jq4m-q6p2-8gwc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_h3"
],
"packageName": "hackney",
"packageURL": "pkg:hex/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_h3.erl"
],
"programRoutines": [
{
"name": "hackney_h3:await_response_loop/6"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "4.0.1",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_h3"
],
"packageName": "benoitc/hackney",
"packageURL": "pkg:github/benoitc/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_h3.erl"
],
"programRoutines": [
{
"name": "hackney_h3:await_response_loop/6"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "3d25f9fea26c90609de9d64366fedfe5065413bc",
"status": "affected",
"version": "0334af206d5099fdf510ed9eda18e34396f065ad",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The application must use the HTTP/3 transport by calling \u003ctt\u003ehackney_h3\u003c/tt\u003e directly or by passing \u003ctt\u003e{transport, h3}\u003c/tt\u003e to \u003ctt\u003ehackney:request/5\u003c/tt\u003e. The default hackney transport (TCP/TLS) is not affected."
}
],
"value": "The application must use the HTTP/3 transport by calling hackney_h3 directly or by passing {transport, h3} to hackney:request/5. The default hackney transport (TCP/TLS) is not affected."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.1",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "AND"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Benoit Chesneau"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding.\u003cp\u003e\u003ctt\u003ehackney_h3:await_response_loop/6\u003c/tt\u003e accumulates the HTTP/3 response body in memory without any size cap. The \u003ctt\u003eafter Timeout\u003c/tt\u003e clause is a per-message inactivity timer that resets on every received chunk, housekeeping message, or settings frame \u2014 it is not a wall-clock deadline. A malicious HTTP/3 server that emits one small chunk every \u003ctt\u003eTimeout - 1\u003c/tt\u003e ms with \u003ctt\u003eFin = false\u003c/tt\u003e and never sends a final frame keeps the loop alive indefinitely while the accumulation buffer grows linearly without bound, eventually exhausting the BEAM process heap and causing an out-of-memory condition.\u003c/p\u003e\u003cp\u003eThis issue affects hackney: from 2.0.0 before 4.0.1.\u003c/p\u003e"
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. hackney_h3:await_response_loop/6 accumulates the HTTP/3 response body in memory without any size cap. The after Timeout clause is a per-message inactivity timer that resets on every received chunk, housekeeping message, or settings frame \u2014 it is not a wall-clock deadline. A malicious HTTP/3 server that emits one small chunk every Timeout - 1 ms with Fin = false and never sends a final frame keeps the loop alive indefinitely while the accumulation buffer grows linearly without bound, eventually exhausting the BEAM process heap and causing an out-of-memory condition.\n\nThis issue affects hackney: from 2.0.0 before 4.0.1."
}
],
"impacts": [
{
"capecId": "CAPEC-125",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-125 Flooding"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T15:40:53.384Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-jq4m-q6p2-8gwc"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-47077.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-47077"
},
{
"tags": [
"patch"
],
"url": "https://github.com/benoitc/hackney/commit/3d25f9fea26c90609de9d64366fedfe5065413bc"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded body accumulation in HTTP/3 response loop in hackney",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-47077",
"datePublished": "2026-05-25T14:00:42.217Z",
"dateReserved": "2026-05-18T17:28:10.319Z",
"dateUpdated": "2026-05-27T15:40:53.384Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47071 (GCVE-0-2026-47071)
Vulnerability from cvelistv5
Published
2026-05-25 14:00
Modified
2026-05-27 15:40
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-400 - Uncontrolled Resource Consumption
Summary
Uncontrolled Resource Consumption vulnerability in benoitc hackney allows Flooding. The SOCKS5 transport in src/hackney_socks5.erl correctly applies the caller-supplied timeout to the SOCKS5 negotiation phase, but then upgrades the connection to TLS using the two-argument form ssl:connect/2, which defaults to an infinite timeout. The Timeout value is in scope at the call site but is not forwarded. A hostile SOCKS5 proxy that completes the SOCKS5 handshake normally and then goes silent (or sends a partial TLS ServerHello and stalls) will cause the connecting process to block indefinitely, regardless of the connect_timeout or recv_timeout options supplied by the caller.
This issue affects hackney: from 0.10.0 before 4.0.1.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47071",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-26T15:48:41.704626Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T15:48:45.842Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-gp9c-pm5m-5cxr"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_socks5"
],
"packageName": "hackney",
"packageURL": "pkg:hex/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_socks5.erl"
],
"programRoutines": [
{
"name": "hackney_socks5:connect/4"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "4.0.1",
"status": "affected",
"version": "0.10.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_socks5"
],
"packageName": "benoitc/hackney",
"packageURL": "pkg:github/benoitc/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_socks5.erl"
],
"programRoutines": [
{
"name": "hackney_socks5:connect/4"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "5ccdab725c561a6f03d05a51f2d0664f98236dae",
"status": "affected",
"version": "34cdbd1d20a282aacc286a89327465a3925b4c5d",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.1",
"versionStartIncluding": "0.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "AND"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Benoit Chesneau"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Uncontrolled Resource Consumption vulnerability in benoitc hackney allows Flooding.\u003cp\u003eThe SOCKS5 transport in \u003ctt\u003esrc/hackney_socks5.erl\u003c/tt\u003e correctly applies the caller-supplied timeout to the SOCKS5 negotiation phase, but then upgrades the connection to TLS using the two-argument form \u003ctt\u003essl:connect/2\u003c/tt\u003e, which defaults to an infinite timeout. The \u003ctt\u003eTimeout\u003c/tt\u003e value is in scope at the call site but is not forwarded. A hostile SOCKS5 proxy that completes the SOCKS5 handshake normally and then goes silent (or sends a partial TLS ServerHello and stalls) will cause the connecting process to block indefinitely, regardless of the \u003ctt\u003econnect_timeout\u003c/tt\u003e or \u003ctt\u003erecv_timeout\u003c/tt\u003e options supplied by the caller.\u003c/p\u003e\u003cp\u003eThis issue affects hackney: from 0.10.0 before 4.0.1.\u003c/p\u003e"
}
],
"value": "Uncontrolled Resource Consumption vulnerability in benoitc hackney allows Flooding. The SOCKS5 transport in src/hackney_socks5.erl correctly applies the caller-supplied timeout to the SOCKS5 negotiation phase, but then upgrades the connection to TLS using the two-argument form ssl:connect/2, which defaults to an infinite timeout. The Timeout value is in scope at the call site but is not forwarded. A hostile SOCKS5 proxy that completes the SOCKS5 handshake normally and then goes silent (or sends a partial TLS ServerHello and stalls) will cause the connecting process to block indefinitely, regardless of the connect_timeout or recv_timeout options supplied by the caller.\n\nThis issue affects hackney: from 0.10.0 before 4.0.1."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T15:40:48.584Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-gp9c-pm5m-5cxr"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-47071.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-47071"
},
{
"tags": [
"patch"
],
"url": "https://github.com/benoitc/hackney/commit/5ccdab725c561a6f03d05a51f2d0664f98236dae"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "SOCKS5 TLS upgrade ignores caller timeout in hackney",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-47071",
"datePublished": "2026-05-25T14:00:41.112Z",
"dateReserved": "2026-05-18T17:28:08.322Z",
"dateUpdated": "2026-05-27T15:40:48.584Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47066 (GCVE-0-2026-47066)
Vulnerability from cvelistv5
Published
2026-05-25 14:00
Modified
2026-05-27 15:40
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Summary
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in benoitc hackney allows Excessive Allocation. The Alt-Svc response header parser in src/hackney_altsvc.erl does not guarantee forward progress. When parse_token/2 receives a non-token, non-whitespace, non-comma byte (e.g. !, @, =, ;), it returns the input unchanged. skip_comma/1 also returns the buffer unchanged when the first byte is not a comma. parse_entries/2 then recurses with identical data, creating a tight infinite tail-recursive loop that pins a scheduler at 100% CPU. The calling process never returns.
The entry point parse_and_cache/3 is called synchronously in the connection process on every HTTP response. A single-byte Alt-Svc: ! response header is sufficient to trigger the hang; the header is fully controlled by any HTTP origin the client connects to.
This issue affects hackney: from 2.0.0-beta.1 before 4.0.1.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47066",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-26T15:50:47.725364Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T15:50:51.330Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-6cp8-v795-jr2j"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_altsvc"
],
"packageName": "hackney",
"packageURL": "pkg:hex/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_altsvc.erl"
],
"programRoutines": [
{
"name": "hackney_altsvc:parse_entries/2"
},
{
"name": "hackney_altsvc:parse_entry/1"
},
{
"name": "hackney_altsvc:parse_protocol/1"
},
{
"name": "hackney_altsvc:parse_token/2"
},
{
"name": "hackney_altsvc:skip_comma/1"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "4.0.1",
"status": "affected",
"version": "2.0.0-beta.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_altsvc"
],
"packageName": "benoitc/hackney",
"packageURL": "pkg:github/benoitc/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_altsvc.erl"
],
"programRoutines": [
{
"name": "hackney_altsvc:parse_entries/2"
},
{
"name": "hackney_altsvc:parse_entry/1"
},
{
"name": "hackney_altsvc:parse_protocol/1"
},
{
"name": "hackney_altsvc:parse_token/2"
},
{
"name": "hackney_altsvc:skip_comma/1"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "e548aba1f97ffa3f4750da7b772998fb78c01894",
"status": "affected",
"version": "408e5fe20302226ea8c74dde2bcbd452d712b5b2",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.1",
"versionStartIncluding": "2.0.0-beta.1",
"vulnerable": true
}
],
"negate": false,
"operator": "AND"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Benoit Chesneau"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in benoitc hackney allows Excessive Allocation.\u003cp\u003eThe Alt-Svc response header parser in \u003ctt\u003esrc/hackney_altsvc.erl\u003c/tt\u003e does not guarantee forward progress. When \u003ctt\u003eparse_token/2\u003c/tt\u003e receives a non-token, non-whitespace, non-comma byte (e.g. \u003ctt\u003e!\u003c/tt\u003e, \u003ctt\u003e@\u003c/tt\u003e, \u003ctt\u003e=\u003c/tt\u003e, \u003ctt\u003e;\u003c/tt\u003e), it returns the input unchanged. \u003ctt\u003eskip_comma/1\u003c/tt\u003e also returns the buffer unchanged when the first byte is not a comma. \u003ctt\u003eparse_entries/2\u003c/tt\u003e then recurses with identical data, creating a tight infinite tail-recursive loop that pins a scheduler at 100% CPU. The calling process never returns.\u003c/p\u003e\u003cp\u003eThe entry point \u003ctt\u003eparse_and_cache/3\u003c/tt\u003e is called synchronously in the connection process on every HTTP response. A single-byte \u003ctt\u003eAlt-Svc: !\u003c/tt\u003e response header is sufficient to trigger the hang; the header is fully controlled by any HTTP origin the client connects to.\u003c/p\u003e\u003cp\u003eThis issue affects hackney: from 2.0.0-beta.1 before 4.0.1.\u003c/p\u003e"
}
],
"value": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in benoitc hackney allows Excessive Allocation. The Alt-Svc response header parser in src/hackney_altsvc.erl does not guarantee forward progress. When parse_token/2 receives a non-token, non-whitespace, non-comma byte (e.g. !, @, =, ;), it returns the input unchanged. skip_comma/1 also returns the buffer unchanged when the first byte is not a comma. parse_entries/2 then recurses with identical data, creating a tight infinite tail-recursive loop that pins a scheduler at 100% CPU. The calling process never returns.\n\nThe entry point parse_and_cache/3 is called synchronously in the connection process on every HTTP response. A single-byte Alt-Svc: ! response header is sufficient to trigger the hang; the header is fully controlled by any HTTP origin the client connects to.\n\nThis issue affects hackney: from 2.0.0-beta.1 before 4.0.1."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T15:40:41.946Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-6cp8-v795-jr2j"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-47066.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-47066"
},
{
"tags": [
"patch"
],
"url": "https://github.com/benoitc/hackney/commit/e548aba1f97ffa3f4750da7b772998fb78c01894"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Infinite loop in Alt-Svc header parser in hackney",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-47066",
"datePublished": "2026-05-25T14:00:39.707Z",
"dateReserved": "2026-05-18T17:28:08.321Z",
"dateUpdated": "2026-05-27T15:40:41.946Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47069 (GCVE-0-2026-47069)
Vulnerability from cvelistv5
Published
2026-05-25 14:00
Modified
2026-05-27 15:40
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Summary
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Response Splitting. The hackney_cookie:setcookie/3 function in src/hackney_cookie.erl validates the Name and Value arguments against CRLF and control characters, but concatenates the domain and path options verbatim into the output iolist with no equivalent check. An attacker who controls either option — for example by supplying a Host header value forwarded as the cookie domain, or a request path forwarded as the cookie path — can inject a literal CRLF sequence and arbitrary additional Set-Cookie headers into the HTTP response.
This issue affects hackney: from 0.9.0 before 4.0.1.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47069",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-26T15:57:10.763778Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T15:57:18.662Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-mp55-p8c9-rfw2"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_cookie"
],
"packageName": "hackney",
"packageURL": "pkg:hex/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_cookie.erl"
],
"programRoutines": [
{
"name": "hackney_cookie:setcookie/3"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "4.0.1",
"status": "affected",
"version": "0.9.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_cookie"
],
"packageName": "benoitc/hackney",
"packageURL": "pkg:github/benoitc/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_cookie.erl"
],
"programRoutines": [
{
"name": "hackney_cookie:setcookie/3"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "8e02b99c28aea1b3fa2ddc0e66f51fe5bb0ac540",
"status": "affected",
"version": "602d5c7f2ea4acbc83ed75230655d935a0750ebc",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.1",
"versionStartIncluding": "0.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "AND"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Benoit Chesneau"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027) vulnerability in benoitc hackney allows HTTP Response Splitting.\u003cp\u003eThe \u003ctt\u003ehackney_cookie:setcookie/3\u003c/tt\u003e function in \u003ctt\u003esrc/hackney_cookie.erl\u003c/tt\u003e validates the \u003ctt\u003eName\u003c/tt\u003e and \u003ctt\u003eValue\u003c/tt\u003e arguments against CRLF and control characters, but concatenates the \u003ctt\u003edomain\u003c/tt\u003e and \u003ctt\u003epath\u003c/tt\u003e options verbatim into the output iolist with no equivalent check. An attacker who controls either option \u2014 for example by supplying a \u003ctt\u003eHost\u003c/tt\u003e header value forwarded as the cookie domain, or a request path forwarded as the cookie path \u2014 can inject a literal CRLF sequence and arbitrary additional \u003ctt\u003eSet-Cookie\u003c/tt\u003e headers into the HTTP response.\u003c/p\u003e\u003cp\u003eThis issue affects hackney: from 0.9.0 before 4.0.1.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027) vulnerability in benoitc hackney allows HTTP Response Splitting. The hackney_cookie:setcookie/3 function in src/hackney_cookie.erl validates the Name and Value arguments against CRLF and control characters, but concatenates the domain and path options verbatim into the output iolist with no equivalent check. An attacker who controls either option \u2014 for example by supplying a Host header value forwarded as the cookie domain, or a request path forwarded as the cookie path \u2014 can inject a literal CRLF sequence and arbitrary additional Set-Cookie headers into the HTTP response.\n\nThis issue affects hackney: from 0.9.0 before 4.0.1."
}
],
"impacts": [
{
"capecId": "CAPEC-34",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-34 HTTP Response Splitting"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93 Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T15:40:38.975Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-mp55-p8c9-rfw2"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-47069.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-47069"
},
{
"tags": [
"patch"
],
"url": "https://github.com/benoitc/hackney/commit/8e02b99c28aea1b3fa2ddc0e66f51fe5bb0ac540"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CRLF injection in cookie domain/path options in hackney",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-47069",
"datePublished": "2026-05-25T14:00:39.394Z",
"dateReserved": "2026-05-18T17:28:08.322Z",
"dateUpdated": "2026-05-27T15:40:38.975Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-6827 (GCVE-0-2024-6827)
Vulnerability from cvelistv5
Published
2025-03-20 10:09
Modified
2025-10-15 12:50
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests
Summary
Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| benoitc | benoitc/gunicorn |
Version: unspecified < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-6827",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-20T17:52:37.458445Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-20T18:32:51.799Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "benoitc/gunicorn",
"vendor": "benoitc",
"versions": [
{
"lessThanOrEqual": "latest",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Gunicorn version 21.2.0 does not properly validate the value of the \u0027Transfer-Encoding\u0027 header as specified in the RFC standards, which leads to the default fallback method of \u0027Content-Length,\u0027 making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-15T12:50:33.638Z",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntr_ai"
},
"references": [
{
"url": "https://huntr.com/bounties/1b4f8f38-39da-44b6-9f98-f618639d0dd7"
}
],
"source": {
"advisory": "1b4f8f38-39da-44b6-9f98-f618639d0dd7",
"discovery": "EXTERNAL"
},
"title": "HTTP Request Smuggling in benoitc/gunicorn"
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntr_ai",
"cveId": "CVE-2024-6827",
"datePublished": "2025-03-20T10:09:55.725Z",
"dateReserved": "2024-07-16T23:32:47.872Z",
"dateUpdated": "2025-10-15T12:50:33.638Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-1135 (GCVE-0-2024-1135)
Vulnerability from cvelistv5
Published
2024-04-16 00:00
Modified
2025-02-13 17:27
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests
Summary
Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability allows for a range of attacks including cache poisoning, session manipulation, and data exposure.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| benoitc | benoitc/gunicorn |
Version: unspecified < |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:benoitc:gunicorn:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gunicorn",
"vendor": "benoitc",
"versions": [
{
"status": "affected",
"version": "*"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-1135",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-19T17:32:23.631972Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:59:56.871Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-12-20T07:02:46.961Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://huntr.com/bounties/22158e34-cfd5-41ad-97e0-a780773d96c1"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00027.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00018.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "benoitc/gunicorn",
"vendor": "benoitc",
"versions": [
{
"lessThanOrEqual": "latest",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn\u0027s handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability allows for a range of attacks including cache poisoning, session manipulation, and data exposure."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-30T23:06:05.937Z",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntr_ai"
},
"references": [
{
"url": "https://huntr.com/bounties/22158e34-cfd5-41ad-97e0-a780773d96c1"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00027.html"
}
],
"source": {
"advisory": "22158e34-cfd5-41ad-97e0-a780773d96c1",
"discovery": "EXTERNAL"
},
"title": "HTTP Request Smuggling in benoitc/gunicorn"
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntr_ai",
"cveId": "CVE-2024-1135",
"datePublished": "2024-04-16T00:00:14.938Z",
"dateReserved": "2024-01-31T18:15:14.296Z",
"dateUpdated": "2025-02-13T17:27:34.444Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}