{"id":"CVE-2026-47070","aliases":["EEF-CVE-2026-47070","EUVD-2026-31692","GHSA-h73q-4w9q-82h4"],"status":"published","title":"HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney","description":"Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackney_h3.erl passes the original request headers unchanged to the redirect target without performing any cross-origin check. When a client issues an HTTP/3 request with follow_redirect enabled and includes Authorization or Cookie headers, a server responding with a 3xx redirect to a different host will cause the client to forward those credentials verbatim to the new origin.\n\nThe main hackney.erl module has maybe_strip_auth_on_redirect/2 (guarded by the location_trusted option) to address CVE-2018-1000007, but hackney_h3.erl is missing this protection entirely.\n\nThis issue affects hackney: from 3.1.1 before 4.0.1.","severity":{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00372,"percentile":0.31567,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2026-05-25T14:00:46Z","modified":"2026-10-28T02:30:51Z","fixes":[{"ecosystem":"Hex","package":"hackney","fixed_in":["4.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Hex","package":"hackney","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1"},{"fixed":"4.0.1"}]}]},{"source":"osv","ecosystem":"Hex","package":"hackney","ranges":[{"type":"SEMVER","events":[{"introduced":"3.1.1"},{"fixed":"4.0.1"}]}],"versions":["3.1.1","3.1.2","3.2.0","3.2.1","4.0.0"]},{"source":"osv","ecosystem":"Hex","package":"hackney","ranges":[{"type":"SEMVER","events":[{"introduced":"3.1.1"},{"fixed":"4.0.1"}]}],"versions":["3.1.1","3.1.2","3.2.0","3.2.1","4.0.0"]}],"products":[{"vendor":"benoitc","product":"hackney"},{"vendor":"hackney","product":"hackney"}],"references":[{"url":"https://github.com/benoitc/hackney/security/advisories/GHSA-h73q-4w9q-82h4","tags":["vendor-advisory","related","exploit","Exploit","Patch","Vendor Advisory","advisory","web"]},{"url":"https://cna.erlef.org/cves/CVE-2026-47070.html","tags":["related","Patch","Third Party Advisory","web"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-47070","tags":["related","Patch","Third Party Advisory","web"]},{"url":"https://github.com/benoitc/hackney/commit/c58d5b50bade146360b85caf3dc8065807b08246","tags":["patch","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47070","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h73q-4w9q-82h4"},{"url":"https://github.com","tags":["web"]},{"url":"https://repo.hex.pm","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47070.json","tags":["advisory"]},{"url":"https://github.com/benoitc/hackney","tags":["package"]},{"url":"https://hex.pm/packages/hackney","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-47070","title":"HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney","description":"Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackney_h3.erl passes the original request headers unchanged to the redirect target without performing any cross-origin check. When a client issues an HTTP/3 request with follow_redirect enabled and includes Authorization or Cookie headers, a server responding with a 3xx redirect to a different host will cause the client to forward those credentials verbatim to the new origin.\n\nThe main hackney.erl module has maybe_strip_auth_on_redirect/2 (guarded by the location_trusted option) to address CVE-2018-1000007, but hackney_h3.erl is missing this protection entirely.\n\nThis issue affects hackney: from 3.1.1 before 4.0.1.","status":"published","published":"2026-05-25T14:00:46.42Z","modified":"2026-05-27T15:41:16.046Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T13:36:29.327819Z"}],"euvd":[{"id":"EUVD-2026-31692","description":"Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackney_h3.erl passes the original request headers unchanged to the redirect target without performing any cross-origin check. When a client issues an HTTP/3 request with follow_redirect enabled and includes Authorization or Cookie headers, a server responding with a 3xx redirect to a different host will cause the client to forward those credentials verbatim to the new origin.\n\nThe main hackney.erl module has maybe_strip_auth_on_redirect/2 (guarded by the location_trusted option) to address CVE-2018-1000007, but hackney_h3.erl is missing this protection entirely.\n\nThis issue affects hackney: from 3.1.1 before 4.0.1.","status":"published","published":"2026-05-25T14:00:46Z","modified":"2026-05-27T15:41:16Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:21:03.926243Z"}],"ghsa":[{"id":"GHSA-h73q-4w9q-82h4","title":"Hackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body","description":"### Summary\n\nThe HTTP/3 redirect handler in `src/hackney_h3.erl` forwards the original request headers (`Authorization`, `Cookie`, `Proxy-Authorization`) and, for 307/308 responses, the original request body to the redirect target without checking whether the target host matches the origin. When `follow_redirect` is enabled and a server responds with a cross-origin `Location`, hackney delivers the caller's credentials verbatim to the attacker-controlled host. The main hackney HTTP/1 client has `maybe_strip_auth_on_redirect/2` (the fix for CVE-2018-1000007); the H3 client was added later without it.\n\n### Details\n\nIn `src/hackney_h3.erl`, `handle_redirect/11` (line 165) extracts the redirect target from the server-controlled `Location` header via `get_redirect_location/1` and resolves it with `resolve_redirect_url/2`, which accepts any absolute `http://` or `https://` URL. It then calls `do_request_with_redirect/8` passing the original `Headers` list unchanged. For 307/308 responses, `redirect_method/2` preserves the original method and body, so the POST body is also forwarded.\n\nNo comparison is made between the original URL's scheme, host, or port and the redirect target. The downstream `connect/3` opens a new QUIC connection to whatever the `Location` header named, and `build_request_headers/4` serializes the unmodified headers into the QPACK-encoded request.\n\n### PoC\n\n1. Issue an HTTP/3 POST to an attacker-controlled origin with `follow_redirect =\u003e true` and an `Authorization: Bearer ...` header.\n2. The attacker's server responds `307 Location: https://other.host/collect`.\n3. hackney opens a new connection to `other.host` and re-sends the original headers and body, including the bearer token and any `Cookie` headers.\n\n### Impact\n\nCredential and request-body disclosure to attacker-controlled origins. Affects hackney 3.1.1 through 4.0.0 when using the HTTP/3 client with `follow_redirect` enabled. Any upstream that is malicious, compromised, or reachable via DNS/MITM can steal session tokens, bearer credentials, and POST bodies. CVSS v4.0: **6.0 (MEDIUM)**.\n\n## Resources\n\n* Introduction commit: https://github.com/benoitc/hackney/commit/e61b7d04b7826847e1efe614106ef4d580c78eab\n* Patch commit: https://github.com/benoitc/hackney/commit/c58d5b50bade146360b85caf3dc8065807b08246","status":"published","published":"2026-06-26T21:56:29Z","modified":"2026-06-26T21:56:32Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:40:34.713036Z"}],"nvd":[{"id":"CVE-2026-47070","description":"Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackney_h3.erl passes the original request headers unchanged to the redirect target without performing any cross-origin check. When a client issues an HTTP/3 request with follow_redirect enabled and includes Authorization or Cookie headers, a server responding with a 3xx redirect to a different host will cause the client to forward those credentials verbatim to the new origin.\n\nThe main hackney.erl module has maybe_strip_auth_on_redirect/2 (guarded by the location_trusted option) to address CVE-2018-1000007, but hackney_h3.erl is missing this protection entirely.\n\nThis issue affects hackney: from 3.1.1 before 4.0.1.","status":"published","published":"2026-05-25T15:16:22.01Z","modified":"2026-07-24T10:10:00.197Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:12:20.131508Z"}],"osv":[{"id":"CVE-2026-47070","title":"HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney","description":"Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackney_h3.erl passes the original request headers unchanged to the redirect target without performing any cross-origin check. When a client issues an HTTP/3 request with follow_redirect enabled and includes Authorization or Cookie headers, a server responding with a 3xx redirect to a different host will cause the client to forward those credentials verbatim to the new origin.\n\nThe main hackney.erl module has maybe_strip_auth_on_redirect/2 (guarded by the location_trusted option) to address CVE-2018-1000007, but hackney_h3.erl is missing this protection entirely.\n\nThis issue affects hackney: from 3.1.1 before 4.0.1.","status":"published","published":"2026-05-25T14:00:46.42Z","modified":"2026-10-28T02:30:51.286675583Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:45:06.231145Z"},{"id":"EEF-CVE-2026-47070","title":"HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney","description":"## Summary\n\nSensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackney\\_h3.erl passes the original request headers unchanged to the redirect target without performing any cross-origin check. When a client issues an HTTP/3 request with follow\\_redirect enabled and includes Authorization or Cookie headers, a server responding with a 3xx redirect to a different host will cause the client to forward those credentials verbatim to the new origin.\n\nThe main hackney.erl module has maybe\\_strip\\_auth\\_on\\_redirect/2 (guarded by the location\\_trusted option) to address CVE-2018-1000007, but hackney\\_h3.erl is missing this protection entirely.\n\nThis issue affects hackney: from 3.1.1 before 4.0.1.","status":"published","published":"2026-05-25T14:00:46.42Z","modified":"2026-07-30T18:22:05.724369Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:33.047032Z"},{"id":"GHSA-h73q-4w9q-82h4","title":"Hackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body","description":"### Summary\n\nThe HTTP/3 redirect handler in `src/hackney_h3.erl` forwards the original request headers (`Authorization`, `Cookie`, `Proxy-Authorization`) and, for 307/308 responses, the original request body to the redirect target without checking whether the target host matches the origin. When `follow_redirect` is enabled and a server responds with a cross-origin `Location`, hackney delivers the caller's credentials verbatim to the attacker-controlled host. The main hackney HTTP/1 client has `maybe_strip_auth_on_redirect/2` (the fix for CVE-2018-1000007); the H3 client was added later without it.\n\n### Details\n\nIn `src/hackney_h3.erl`, `handle_redirect/11` (line 165) extracts the redirect target from the server-controlled `Location` header via `get_redirect_location/1` and resolves it with `resolve_redirect_url/2`, which accepts any absolute `http://` or `https://` URL. It then calls `do_request_with_redirect/8` passing the original `Headers` list unchanged. For 307/308 responses, `redirect_method/2` preserves the original method and body, so the POST body is also forwarded.\n\nNo comparison is made between the original URL's scheme, host, or port and the redirect target. The downstream `connect/3` opens a new QUIC connection to whatever the `Location` header named, and `build_request_headers/4` serializes the unmodified headers into the QPACK-encoded request.\n\n### PoC\n\n1. Issue an HTTP/3 POST to an attacker-controlled origin with `follow_redirect =\u003e true` and an `Authorization: Bearer ...` header.\n2. The attacker's server responds `307 Location: https://other.host/collect`.\n3. hackney opens a new connection to `other.host` and re-sends the original headers and body, including the bearer token and any `Cookie` headers.\n\n### Impact\n\nCredential and request-body disclosure to attacker-controlled origins. Affects hackney 3.1.1 through 4.0.0 when using the HTTP/3 client with `follow_redirect` enabled. Any upstream that is malicious, compromised, or reachable via DNS/MITM can steal session tokens, bearer credentials, and POST bodies. CVSS v4.0: **6.0 (MEDIUM)**.\n\n## Resources\n\n* Introduction commit: https://github.com/benoitc/hackney/commit/e61b7d04b7826847e1efe614106ef4d580c78eab\n* Patch commit: https://github.com/benoitc/hackney/commit/c58d5b50bade146360b85caf3dc8065807b08246","status":"published","published":"2026-06-26T21:56:29Z","modified":"2026-06-26T22:00:11.492108003Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:48.920784Z"}]}}