Vulnerabilities

Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body.

Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly…

Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port…

Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot.

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback…

erlang_quic is a pure Erlang QUIC implementation.

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding.

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding.

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Request/Response Splitting.

Interpretation Conflict vulnerability in benoitc hackney allows Server Side Request Forgery.

Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data.

Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting.

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding.

Uncontrolled Resource Consumption vulnerability in benoitc hackney allows Flooding.

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in benoitc hackney allows Excessive Allocation.

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Response Splitting.

Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE…

Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities.