hackney
4.10.2
Simple HTTP client with HTTP/1.1, HTTP/2, and HTTP/3 support
Current section
17 Advisories
Jump to
Current section
17 Advisories
Unbounded response body buffering and decompression in hackney
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-97200.html
- https://github.com/benoitc/hackney/commit/493e8bf83a391548e5101792276ab3fc428fa76c
- https://github.com/benoitc/hackney/commit/dc41b79339ca0c41e16d3f2dd17172bc2de855d6
- https://github.com/benoitc/hackney/pull/980
- https://github.com/benoitc/hackney/releases/tag/4.9.0
- https://hex.pm/packages/hackney
Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-115693.html
- https://github.com/benoitc/hackney/commit/915eb5737e9c489d8fc22eec8cdae30e9b027be4
- https://github.com/benoitc/hackney/commit/d8a9afcf5c3849904274e2eba1df56c63d1a1a0c
- https://github.com/benoitc/hackney/pull/978
- https://github.com/benoitc/hackney/releases/tag/4.9.0
- https://hex.pm/packages/hackney
HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-113440.html
- https://github.com/benoitc/hackney/commit/6548384b22ea196023a1963e2967d5715b6d9564
- https://github.com/benoitc/hackney/commit/8f944559bdb83da60b5c06f6cf6d842591278364
- https://github.com/benoitc/hackney/pull/979
- https://github.com/benoitc/hackney/releases/tag/4.9.0
- https://hex.pm/packages/hackney
SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-115700.html
- https://github.com/benoitc/hackney/commit/452620a92ec1da2e6b4862a049a2a4f04b42068f
- https://github.com/benoitc/hackney/commit/f19561a0b422376348c91537e51377ab7325f4ee
- https://github.com/benoitc/hackney/pull/987
- https://github.com/benoitc/hackney/releases/tag/4.9.0
- https://hex.pm/packages/hackney
CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-112880.html
- https://github.com/benoitc/hackney/commit/5df5a74a2817d5b12880d217db33253ff1fae1b5
- https://github.com/benoitc/hackney/commit/5ee7d7d19eba27e774667d472feb1e93a08af7f9
- https://github.com/benoitc/hackney/pull/989
- https://github.com/benoitc/hackney/releases/tag/4.9.0
- https://hex.pm/packages/hackney
Atom table exhaustion via unrecognized URL schemes in hackney
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-47067.html
- https://github.com/benoitc/hackney
- https://github.com/benoitc/hackney/commit/31f6f0e27e096ad88743dfded4f030a3ee74972e
- https://github.com/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62
- https://hex.pm/packages/hackney
- https://nvd.nist.gov/vuln/detail/CVE-2026-47067
- https://osv.dev/vulnerability/EEF-CVE-2026-47067
Unbounded memory consumption in WebSocket client in hackney
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-47073.html
- https://github.com/benoitc/hackney
- https://github.com/benoitc/hackney/commit/ce0109e2970ace6e20ff29bae9d05c3ac22ec6dc
- https://github.com/benoitc/hackney/security/advisories/GHSA-q8jg-fgj4-fphf
- https://hex.pm/packages/hackney
- https://nvd.nist.gov/vuln/detail/CVE-2026-47073
- https://osv.dev/vulnerability/EEF-CVE-2026-47073
CRLF injection in WebSocket upgrade request in hackney
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-47072.html
- https://github.com/benoitc/hackney
- https://github.com/benoitc/hackney/commit/52310ca807e7b48441ba0e9129171f535313fdd1
- https://github.com/benoitc/hackney/security/advisories/GHSA-f9vr-g2g2-x9fg
- https://hex.pm/packages/hackney
- https://nvd.nist.gov/vuln/detail/CVE-2026-47072
- https://osv.dev/vulnerability/EEF-CVE-2026-47072
CR/LF injection in query parameter in hackney
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-47075.html
- https://github.com/benoitc/hackney
- https://github.com/benoitc/hackney/commit/ca73dd0aba0ed557449c18288bf07241671a43c9
- https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf
- https://hex.pm/packages/hackney
- https://nvd.nist.gov/vuln/detail/CVE-2026-47075
- https://osv.dev/vulnerability/EEF-CVE-2026-47075
Unbounded body accumulation in HTTP/3 response loop in hackney
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-47077.html
- https://github.com/benoitc/hackney
- https://github.com/benoitc/hackney/commit/3d25f9fea26c90609de9d64366fedfe5065413bc
- https://github.com/benoitc/hackney/security/advisories/GHSA-jq4m-q6p2-8gwc
- https://github.com/ex-aws/ex_aws_sns/security/advisories/GHSA-8jgf-23q5-x7xx
- https://hex.pm/packages/hackney
- https://nvd.nist.gov/vuln/detail/CVE-2026-47077
- https://osv.dev/vulnerability/EEF-CVE-2026-47077
HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-47070.html
- https://github.com/benoitc/hackney
- https://github.com/benoitc/hackney/commit/c58d5b50bade146360b85caf3dc8065807b08246
- https://github.com/benoitc/hackney/security/advisories/GHSA-h73q-4w9q-82h4
- https://hex.pm/packages/hackney
- https://nvd.nist.gov/vuln/detail/CVE-2026-47070
- https://osv.dev/vulnerability/EEF-CVE-2026-47070
SSRF allowlist bypass via percent-encoded host in hackney
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-47076.html
- https://github.com/benoitc/hackney
- https://github.com/benoitc/hackney/commit/452620a92ec1da2e6b4862a049a2a4f04b42068f
- https://github.com/benoitc/hackney/security/advisories/GHSA-pj7v-xfvx-wmjq
- https://hex.pm/packages/hackney
- https://nvd.nist.gov/vuln/detail/CVE-2026-47076
- https://osv.dev/vulnerability/EEF-CVE-2026-47076
CRLF injection in cookie domain/path options in hackney
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-47069.html
- https://github.com/benoitc/hackney
- https://github.com/benoitc/hackney/commit/8e02b99c28aea1b3fa2ddc0e66f51fe5bb0ac540
- https://github.com/benoitc/hackney/security/advisories/GHSA-mp55-p8c9-rfw2
- https://hex.pm/packages/hackney
- https://nvd.nist.gov/vuln/detail/CVE-2026-47069
- https://osv.dev/vulnerability/EEF-CVE-2026-47069
SOCKS5 TLS upgrade ignores caller timeout in hackney
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-47071.html
- https://github.com/benoitc/hackney
- https://github.com/benoitc/hackney/commit/5ccdab725c561a6f03d05a51f2d0664f98236dae
- https://github.com/benoitc/hackney/security/advisories/GHSA-gp9c-pm5m-5cxr
- https://hex.pm/packages/hackney
- https://nvd.nist.gov/vuln/detail/CVE-2026-47071
- https://osv.dev/vulnerability/EEF-CVE-2026-47071
Infinite loop in Alt-Svc header parser in hackney
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-47066.html
- https://github.com/benoitc/hackney
- https://github.com/benoitc/hackney/commit/e548aba1f97ffa3f4750da7b772998fb78c01894
- https://github.com/benoitc/hackney/security/advisories/GHSA-6cp8-v795-jr2j
- https://hex.pm/packages/hackney
- https://nvd.nist.gov/vuln/detail/CVE-2026-47066
- https://osv.dev/vulnerability/EEF-CVE-2026-47066
Hackney fails to properly release HTTP connections to the pool
Affected Versions
Server-side Request Forgery (SSRF) in hackney
Affected Versions
References
- https://gist.github.com/snoopysecurity/996de09ec0cfd0ebdcfdda8ff515deb1
- https://github.com/benoitc/hackney
- https://github.com/benoitc/hackney/commit/9594ce58fabd32cd897fc28fae937694515a3d4a
- https://github.com/benoitc/hackney/releases/tag/1.21.0
- https://nvd.nist.gov/vuln/detail/CVE-2025-1211
- https://security.snyk.io/vuln/SNYK-HEX-HACKNEY-6516131
- https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf
Checksum
Dependency Config
mix.exs
rebar.config
Gleam
erlang.mk
Package Details
this version
3 131
yesterday
52 526
last 7 days
325 682
all time
174 924 988
