Skip to main content
cve.nowby Sazabi
← Hex
HexPackage

hackney

17 known vulnerabilities (1 critical, 6 high, 7 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
17 · 1 critical, 6 high, 7 medium, 3 low
Registry
Hex

Advisories 17

  • Unbounded response body buffering and decompression in hackney

    Affected: from 2.0.0-beta.1, fixed in 4.9.0.

  • CVE-2026-115693Critical 9.1

    Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney

    Affected: from 1.24.0, fixed in 4.9.0.

  • CVE-2026-113440Medium 6.0

    HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney

    Affected: from 2.0.0, fixed in 4.9.0.

  • CVE-2026-115700Medium 6.9

    SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney

    Affected: from 4.0.1, fixed in 4.9.0.

  • CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney

    Affected: from 2.0.0, fixed in 4.9.0.

  • Unbounded memory consumption in WebSocket client in hackney

    Affected: from 2.0.0, fixed in 4.0.1; from 2.0.0, fixed in 4.0.1.

  • Atom table exhaustion via unrecognized URL schemes in hackney

    Affected: from 2.0.0, fixed in 4.0.1; from 2.0.0, fixed in 4.0.1.

  • CVE-2026-47072Medium 6.9

    CRLF injection in WebSocket upgrade request in hackney

    Affected: from 2.0.0, fixed in 4.0.1; from 2.0.0, fixed in 4.0.1.

  • CVE-2026-47076Medium 6.9

    SSRF allowlist bypass via percent-encoded host in hackney

    Affected: from 0.13.0, fixed in 4.0.1; from 0.13.0, fixed in 4.0.1.

  • CVE-2026-47070Medium 6.0

    HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney

    Affected: from 3.1.1, fixed in 4.0.1; from 3.1.1, fixed in 4.0.1.

  • CVE-2026-47075Medium 6.8

    CR/LF injection in query parameter in hackney

    Affected: from 0.13.1, fixed in 4.0.1; from 0.13.1, fixed in 4.0.1; fixed in 4.0.1.

  • Unbounded body accumulation in HTTP/3 response loop in hackney

    Affected: from 2.0.0, fixed in 4.0.1; from 2.0.0, fixed in 4.0.1.

  • SOCKS5 TLS upgrade ignores caller timeout in hackney

    Affected: from 0.10.0, fixed in 4.0.1; from 0.10.0, fixed in 4.0.1.

  • Infinite loop in Alt-Svc header parser in hackney

    Affected: from 2.0.0-beta.1, fixed in 4.0.1; from 2.0.0-beta.1, fixed in 4.0.1; from 2.0.0, fixed in 4.0.1.

  • CRLF injection in cookie domain/path options in hackney

    Affected: from 0.9.0, fixed in 4.0.1; from 0.9.0, fixed in 4.0.1.

Show all 17 advisoriesShow fewer advisories

  • Connection pool exhaustion in hackney

    Affected: fixed in 1.24.0.

  • CVE-2025-1211Medium 6.3

    Versions of the package hackney before 1.21.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI…

    Affected: fixed in 1.21.0.