benoitc hackney vulnerabilities

Newest CVEs

• CVE-2026-97200

  Unbounded response body buffering and decompression in hackney

  benoitc · hackney

  High8.2
• CVE-2026-115693

  Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney

  benoitc · hackney

  Critical9.1
• CVE-2026-113440

  HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney

  benoitc · hackney

  Medium6.0
• CVE-2026-115700

  SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney

  benoitc · hackney

  Medium6.9
• CVE-2026-112880

  CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney

  benoitc · hackney

  Low2.1
• CVE-2026-47073

  Unbounded memory consumption in WebSocket client in hackney

  benoitc · hackney

  High8.7
• CVE-2026-47067

  Atom table exhaustion via unrecognized URL schemes in hackney

  benoitc · hackney

  High8.7
• CVE-2026-47072

  CRLF injection in WebSocket upgrade request in hackney

  benoitc · hackney

  Medium6.9
• CVE-2026-47076

  SSRF allowlist bypass via percent-encoded host in hackney

  benoitc · hackney

  Medium6.9
• CVE-2026-47070

  HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney

  benoitc · hackney

  Medium6.0