benoitc hackney
15 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-97200 | 2.0.0-beta.1 – < 4.9.0 | Unbounded response body buffering and decompression in hackney | HIGH 8.2 | 0.6 % | ||
| CVE-2026-115693 | 1.24.0 – < 4.9.0 | Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney | CRITICAL 9.1 | 0.3 % | ||
| CVE-2026-113440 | 2.0.0 – < 4.9.0 | HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney | MEDIUM 6.0 | 0.3 % | ||
| CVE-2026-115700 | 4.0.1 – < 4.9.0 | SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney | MEDIUM 6.9 | 0.1 % | ||
| CVE-2026-112880 | 2.0.0 – < 4.9.0 | CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney | LOW 2.1 | 0.2 % | ||
| CVE-2026-47073 | 2.0.0 – < 4.0.1 | Unbounded memory consumption in WebSocket client in hackney | HIGH 8.7 | 0.9 % | ||
| CVE-2026-47067 | 2.0.0 – < 4.0.1 | Atom table exhaustion via unrecognized URL schemes in hackney | HIGH 8.7 | 0.8 % | ||
| CVE-2026-47072 | 2.0.0 – < 4.0.1 | CRLF injection in WebSocket upgrade request in hackney | MEDIUM 6.9 | 0.5 % | ||
| CVE-2026-47076 | 0.13.0 – < 4.0.1 | SSRF allowlist bypass via percent-encoded host in hackney | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-47070 | 3.1.1 – < 4.0.1 | HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney | MEDIUM 6.0 | 0.4 % | ||
| CVE-2026-47075 | 0.13.1 – < 4.0.1 | CR/LF injection in query parameter in hackney | MEDIUM 6.8 | 0.5 % | ||
| CVE-2026-47077 | 2.0.0 – < 4.0.1 | Unbounded body accumulation in HTTP/3 response loop in hackney | HIGH 8.2 | 0.7 % | ||
| CVE-2026-47071 | 0.10.0 – < 4.0.1 | SOCKS5 TLS upgrade ignores caller timeout in hackney | HIGH 8.2 | 0.8 % | ||
| CVE-2026-47069 | 0.9.0 – < 4.0.1 | CRLF injection in cookie domain/path options in hackney | LOW 2.1 | 0.4 % | ||
| CVE-2026-47066 | 2.0.0-beta.1 – < 4.0.1 | Infinite loop in Alt-Svc header parser in hackney | HIGH 8.7 | 0.8 % |