Custom CA pinning bypass in hackney accepts public root certificates
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-295.
Summary
hackney, an Erlang HTTP client, contains an improper certificate validation flaw from 1.24.0 before 4.9.0 (CWE-295). When a caller replaces the trust store with cacerts or cacertfile, hackney keeps a partial chain callback that trusts any publicly trusted root in the peer chain, so a connection pinned to a private certificate authority still accepts chains ending in a public root. An on-path attacker who holds a publicly trusted certificate for the pinned hostname can impersonate the server. The hostname check still applies.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root. The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname. This issue affects hackney: from 1.24.0 before 4.9.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade hackney to version 4.9.0 or later. The sources list no fixed version for hackney prior to 4.9.0 in other branches.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA hackney (benoitc) Fixed in 4.9.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
benoitc hackney — hackney 4.9.0 release notes
5 records Highest priority Priority MEDIUM 2 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2026-80354 Unbounded response body buffering in hackney allows memory exhaustionPriority MEDIUM 42
- TI-2026-80384 SSRF allowlist bypass via encoded IPv6 literal in hackneyPriority LOW 29
- TI-2026-80370 hackney resends credentials on same-host redirects to another scheme or portPriority LOW 27
Timeline
- 2026-10-26 Threatist record created from CVE-2026-115693
- 2026-10-27 Alias added: GHSA-g7gg-9jhv-68h6
- 2026-10-27 Priority changed: MEDIUM → LOW
- 2026-11-02 CISA SSVC decision points changed
- 2026-11-02 Priority changed: LOW → MEDIUM
References
More benoitc vulnerabilities
- TI-2026-34675 Unbounded memory consumption in WebSocket client in hackney CVSS 4.0HIGH 8.7
- TI-2026-34669 Atom table exhaustion via unrecognized URL schemes in hackney CVSS 4.0HIGH 8.7
- TI-2026-34668 Infinite loop in Alt-Svc header parser in hackney CVSS 4.0HIGH 8.7
- TI-2026-34679 Unbounded body accumulation in HTTP/3 response loop in hackney CVSS 4.0HIGH 8.2
- TI-2026-34673 SOCKS5 TLS upgrade ignores caller timeout in hackney CVSS 4.0HIGH 8.2
- TI-2024-06330 HTTP Request Smuggling in benoitc/gunicorn CVSS 3.0HIGH 7.5
Sources
- CVE-2026-115693 · CVE Program
- CVE-2026-115693 · NVD
- FIRST EPSS
- GHSA-g7gg-9jhv-68h6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences