Vulnerabilities

TI-2026-34675 CVE-2026-47073 · GHSA-q8jg-fgj4-fphf

Unbounded memory consumption in WebSocket client in hackney

HIGH 77

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00853 Published 2026-05-25 Fixed in 4.0.1 CWE-400

TI-2026-34669 CVE-2026-47067 · GHSA-9653-rcfr-5c62

Atom table exhaustion via unrecognized URL schemes in hackney

HIGH 77

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00753 Published 2026-05-25 Fixed in 4.0.1 CWE-770

TI-2026-34674 CVE-2026-47072 · GHSA-f9vr-g2g2-x9fg

CRLF injection in WebSocket upgrade request in hackney

HIGH 70

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Request/Response Splitting.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00542 Published 2026-05-25 Fixed in 4.0.1 CWE-93

TI-2026-34678 CVE-2026-47076 · GHSA-pj7v-xfvx-wmjq

SSRF allowlist bypass via percent-encoded host in hackney

MEDIUM 64

Interpretation Conflict vulnerability in benoitc hackney allows Server Side Request Forgery.

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00229 Published 2026-05-25 Fixed in 4.0.1 CWE-436

TI-2026-34672 CVE-2026-47070 · GHSA-h73q-4w9q-82h4

HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney

MEDIUM 60

Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data.

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.00372 Published 2026-05-25 Fixed in 4.0.1 CWE-601

TI-2026-34677 CVE-2026-47075 · GHSA-j9wq-vxxc-94wf

CR/LF injection in query parameter in hackney

MEDIUM 63

Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting.

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.00479 Published 2026-05-25 Fixed in 4.0.1 CWE-93

TI-2026-34679 CVE-2026-47077 · GHSA-jq4m-q6p2-8gwc

Unbounded body accumulation in HTTP/3 response loop in hackney

HIGH 75

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00703 Published 2026-05-25 Fixed in 4.0.1 CWE-400

TI-2026-34673 CVE-2026-47071 · GHSA-gp9c-pm5m-5cxr

SOCKS5 TLS upgrade ignores caller timeout in hackney

HIGH 75

Uncontrolled Resource Consumption vulnerability in benoitc hackney allows Flooding.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00753 Published 2026-05-25 Fixed in 4.0.1 CWE-400

TI-2026-34668 CVE-2026-47066 · GHSA-6cp8-v795-jr2j

Infinite loop in Alt-Svc header parser in hackney

HIGH 77

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in benoitc hackney allows Excessive Allocation.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00753 Published 2026-05-25 Fixed in 4.0.1 CWE-835

TI-2026-34671 CVE-2026-47069 · GHSA-mp55-p8c9-rfw2

CRLF injection in cookie domain/path options in hackney

MEDIUM 44

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Response Splitting.

CVSS 4.0LOW 2.1 Local No auth No interaction EPSS 0.00425 Published 2026-05-25 Fixed in 4.0.1 CWE-93

Vulnerabilities

Filters