Read the docs
TI-2026-80384 Aliases CVE-2026-115700GHSA-8c7g-m8h7-q24x

SSRF allowlist bypass via encoded IPv6 literal in hackney

Priority LOW 29CWE-436Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

The hackney package from benoitc, from 4.0.1 before 4.9.0, has an interpretation conflict in hackney_url that enables server-side request forgery. A caller's allowlist sees a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot as a plain hostname, while hackney connects to the address it denotes. An attacker who controls a URL can therefore reach internal addresses such as loopback despite the allowlist, and the same applies to redirect Location targets. The flaw is classified as CWE-436 and CWE-918, and exploitation requires a local user with low privileges.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D (decoding to [::ffff:127.0.0.1]) or 127.0.0.1. is not an IP address to a caller's allowlist built on uri_string:parse/1 and inet:parse_address/1, while hackney connects to the address it denotes. The same applies to a Location target when redirects are followed. The IP-literal gate that hackney_url:normalize/2 applies to a percent-decoded host, added to close the percent-encoded IP bypass of CVE-2026-47076, passes the decoded value to inet_parse:address/1 as is. The connect path in hackney_happy:parse_address/1 drops a surrounding bracket pair, and the resolver ignores a trailing dot, so both forms pass the gate and still reach the literal address. Domain names with a trailing dot and unencoded IPv6 literals are not affected. This issue affects hackney: from 4.0.1 before 4.9.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00138 3rd percentileScored 2026-11-07
Fix Fixed hackney (benoitc): 4.9.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
benoitchackney4.0.1 to before 4.9.04.9.0Patch availableCNA
  • hackney Vendorbenoitc Affected 4.0.1 to before 4.9.0 Fixed in 4.9.0 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*——benoitc
  • cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:* Versions — — ·benoitc

Remediation

Upgrade hackney to version 4.9.0 or later, which fixes the issue. The sources list no fixed version for other hackney releases.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA hackney (benoitc) Fixed in 4.9.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    benoitc hackney — hackney 4.9.0 release notes

    5 records Highest priority Priority MEDIUM 2 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-80354 Unbounded response body buffering in hackney allows memory exhaustionPriority MEDIUM 42
    • TI-2026-80383 Custom CA pinning bypass in hackney accepts public root certificatesPriority MEDIUM 41
    • TI-2026-80370 hackney resends credentials on same-host redirects to another scheme or portPriority LOW 27
    Show all 5 records → Advisory →

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-115700
  2. 2026-10-27 Alias added: GHSA-8c7g-m8h7-q24x
  3. 2026-10-27 Priority changed: MEDIUM → LOW
  4. 2026-11-02 CISA SSVC decision points changed

References

Patch 1

Advisory 1

Other 4

  • TI-2026-34675 Unbounded memory consumption in WebSocket client in hackney CVSS 4.0HIGH 8.7
  • TI-2026-34669 Atom table exhaustion via unrecognized URL schemes in hackney CVSS 4.0HIGH 8.7
  • TI-2026-34668 Infinite loop in Alt-Svc header parser in hackney CVSS 4.0HIGH 8.7
  • TI-2026-34679 Unbounded body accumulation in HTTP/3 response loop in hackney CVSS 4.0HIGH 8.2
  • TI-2026-34673 SOCKS5 TLS upgrade ignores caller timeout in hackney CVSS 4.0HIGH 8.2
  • TI-2024-06330 HTTP Request Smuggling in benoitc/gunicorn CVSS 3.0HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences