Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Advisory: benoitc hackney — hackney 4.9.0 release notes Clear all filters
TI-2026-80354 CVE-2026-97200 · GHSA-wpmp-4grc-56ph

Unbounded response body buffering in hackney allows memory exhaustion

Priority MEDIUM 42

Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00564 Published 2026-10-26 Fixed in 4.9.0 CWE-409
TI-2026-80383 CVE-2026-115693 · GHSA-g7gg-9jhv-68h6

Custom CA pinning bypass in hackney accepts public root certificates

Priority MEDIUM 41

Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly…

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00267 Published 2026-10-26 Fixed in 4.9.0 CWE-295
TI-2026-80370 CVE-2026-113440 · GHSA-m347-hm9w-wwv9

hackney resends credentials on same-host redirects to another scheme or port

Priority LOW 27

Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port…

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.00313 Published 2026-10-26 Fixed in 4.9.0 CWE-522
TI-2026-80384 CVE-2026-115700 · GHSA-8c7g-m8h7-q24x

SSRF allowlist bypass via encoded IPv6 literal in hackney

Priority LOW 29

Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot.

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00138 Published 2026-10-26 Fixed in 4.9.0 CWE-436
TI-2026-80368 CVE-2026-112880 · GHSA-5qp8-qrjx-2669

hackney CRLF injection via Proxy-Authorization from proxy_auth_fun

Priority LOW 10

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback…

CVSS 4.0LOW 2.1 Local No auth No interaction EPSS 0.00188 Published 2026-10-26 Fixed in 4.9.0 CWE-113