Read the docs
TI-2026-34678 Aliases CVE-2026-47076GHSA-pj7v-xfvx-wmjq

SSRF allowlist bypass via percent-encoded host in hackney

Priority MEDIUM 64CWE-436Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

Interpretation Conflict vulnerability in benoitc hackney allows Server Side Request Forgery. hackney_url:normalize/2 URL-decodes the host component after the URL has been parsed into a #hackney_url{} record. OTP's uri_string:parse/1 and inet:parse_address/1 do not decode percent-escapes in the host, so a URL such as http://%31%32%37%2E%30%2E%30%2E%31/ is seen by a caller's allowlist validator with host %31%32%37%2E%30%2E%30%2E%31 (not an IP address), which passes the allowlist check. hackney's normalizer then decodes the host to 127.0.0.1 and opens a TCP connection to loopback. Because hackney:request/5 always calls hackney_url:normalize/2 with no opt-out, every request that takes a binary or list URL is affected. The same technique reaches cloud instance metadata services (169.254.169.254), RFC1918 networks, and any admin interface listening on localhost. This issue affects hackney: from 0.13.0 before 4.0.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00229 13th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed hackney (benoitc): 4.0.1hackney (Hex): 4.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
benoitchackney0.13.0 to before 4.0.14.0.1Patch availableCNA
—hackney (Hex)0.13.0 to before 4.0.14.0.1Patch availableGHSA-pj7v-xfvx-wmjq
  • hackney Vendorbenoitc Affected 0.13.0 to before 4.0.1 Fixed in 4.0.1 Patch available CNA
  • hackney (Hex) Vendor— Affected 0.13.0 to before 4.0.1 Fixed in 4.0.1 Patch available GHSA-pj7v-xfvx-wmjq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*0.13.0 to before 4.0.1Vulnerablebenoitc
  • cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:* Versions 0.13.0 to before 4.0.1 Vulnerable ·benoitc

Remediation

  • Fix · CNA hackney (benoitc) Fixed in 4.0.1
  • Fix · GHSA-pj7v-xfvx-wmjq hackney (Hex) Fixed in 4.0.1 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    benoitc hackney 4.0.1

    10 records Highest priority Priority HIGH 6 HIGH, 4 MEDIUM

    Other records, highest priority first

    • TI-2026-34675 Unbounded memory consumption in WebSocket client in hackneyPriority HIGH 77
    • TI-2026-34669 Atom table exhaustion via unrecognized URL schemes in hackneyPriority HIGH 77
    • TI-2026-34668 Infinite loop in Alt-Svc header parser in hackneyPriority HIGH 77
    Show all 10 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47076
  2. 2026-10-03 Alias added: GHSA-pj7v-xfvx-wmjq

References

Exploit 1

Patch 3

Advisory 1

Other 1

  • TI-2026-34675 Unbounded memory consumption in WebSocket client in hackney CVSS 4.0HIGH 8.7
  • TI-2026-34669 Atom table exhaustion via unrecognized URL schemes in hackney CVSS 4.0HIGH 8.7
  • TI-2026-34668 Infinite loop in Alt-Svc header parser in hackney CVSS 4.0HIGH 8.7
  • TI-2026-34679 Unbounded body accumulation in HTTP/3 response loop in hackney CVSS 4.0HIGH 8.2
  • TI-2026-34673 SOCKS5 TLS upgrade ignores caller timeout in hackney CVSS 4.0HIGH 8.2
  • TI-2026-34674 CRLF injection in WebSocket upgrade request in hackney CVSS 4.0MEDIUM 6.9
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences