Read the docs

benoitc

Records18All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high8CVSS 7.0–8.9

Exploited now

benoitc records in CISA KEV

No benoitc vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Hackney 10 records HIGH

Records

18 records

TI-2026-34668 CVE-2026-47066 · GHSA-6cp8-v795-jr2j

Infinite loop in Alt-Svc header parser in hackney

Priority HIGH 77

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in benoitc hackney allows Excessive Allocation.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00753 Published 2026-05-25 Fixed in 4.0.1 CWE-835
TI-2024-06330 CVE-2024-6827 · GHSA-hc5x-x2vx-497g

HTTP Request Smuggling in benoitc/gunicorn

Priority HIGH 72

Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00806 Published 2025-03-20 Partial fix · 22.0.0 CWE-444
TI-2026-34674 CVE-2026-47072 · GHSA-f9vr-g2g2-x9fg

CRLF injection in WebSocket upgrade request in hackney

Priority HIGH 70

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Request/Response Splitting.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00542 Published 2026-05-25 Fixed in 4.0.1 CWE-93
TI-2026-34677 CVE-2026-47075 · GHSA-j9wq-vxxc-94wf

CR/LF injection in query parameter in hackney

Priority MEDIUM 63

Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting.

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.00479 Published 2026-05-25 Fixed in 4.0.1 CWE-93
TI-2026-36612 CVE-2026-49457 · GHSA-2r8v-p65x-3663

QUIC has Broken TLS verification

Priority MEDIUM 47

erlang_quic is a pure Erlang QUIC implementation.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00249 Published 2026-08-14 Fixed in 1.4.4 CWE-295
TI-2024-01052 CVE-2024-1135 · GHSA-w3h3-4rj7-4ph4

HTTP Request Smuggling in benoitc/gunicorn

Priority MEDIUM 46

Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02996 Published 2024-04-16 Partial fix · 22.0.0 CWE-444
TI-2026-34671 CVE-2026-47069 · GHSA-mp55-p8c9-rfw2

CRLF injection in cookie domain/path options in hackney

Priority MEDIUM 44

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Response Splitting.

CVSS 4.0LOW 2.1 Local No auth No interaction EPSS 0.00425 Published 2026-05-25 Fixed in 4.0.1 CWE-93
TI-2026-80354 CVE-2026-97200 · GHSA-wpmp-4grc-56ph

Unbounded response body buffering in hackney allows memory exhaustion

Priority MEDIUM 42

Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00564 Published 2026-10-26 Fixed in 4.9.0 CWE-409
TI-2026-80383 CVE-2026-115693 · GHSA-g7gg-9jhv-68h6

Custom CA pinning bypass in hackney accepts public root certificates

Priority MEDIUM 41

Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly…

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00267 Published 2026-10-26 Fixed in 4.9.0 CWE-295
TI-2026-80384 CVE-2026-115700 · GHSA-8c7g-m8h7-q24x

SSRF allowlist bypass via encoded IPv6 literal in hackney

Priority LOW 29

Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot.

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00138 Published 2026-10-26 Fixed in 4.9.0 CWE-436
TI-2026-80370 CVE-2026-113440 · GHSA-m347-hm9w-wwv9

hackney resends credentials on same-host redirects to another scheme or port

Priority LOW 27

Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port…

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.00313 Published 2026-10-26 Fixed in 4.9.0 CWE-522
TI-2026-80368 CVE-2026-112880 · GHSA-5qp8-qrjx-2669

hackney CRLF injection via Proxy-Authorization from proxy_auth_fun

Priority LOW 10

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback…

CVSS 4.0LOW 2.1 Local No auth No interaction EPSS 0.00188 Published 2026-10-26 Fixed in 4.9.0 CWE-113
Open these records in search →