Hackney vulnerabilities

Products

• Hackney 17

Newest

• benoitc hackney Unbounded response body buffering and decompression in hackney CVE-2026-97200 Fix available 8.2 HighOctober 26, 2026
• benoitc hackney Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney CVE-2026-115693 Fix available 9.1 CriticalOctober 26, 2026
• benoitc hackney HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney CVE-2026-113440 Fix available 6.0 MediumOctober 26, 2026
• benoitc hackney SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney CVE-2026-115700 Fix available 6.9 MediumOctober 26, 2026
• benoitc hackney CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney CVE-2026-112880 Fix available 2.1 LowOctober 26, 2026
• benoitc hackney Unbounded memory consumption in WebSocket client in hackney CVE-2026-47073 Fix available 8.7 HighMay 25, 2026
• benoitc hackney Atom table exhaustion via unrecognized URL schemes in hackney CVE-2026-47067 Fix available 8.7 HighMay 25, 2026
• benoitc hackney CRLF injection in WebSocket upgrade request in hackney CVE-2026-47072 Fix available 6.9 MediumMay 25, 2026
• benoitc hackney SSRF allowlist bypass via percent-encoded host in hackney CVE-2026-47076 Fix available 6.9 MediumMay 25, 2026
• benoitc hackney HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney CVE-2026-47070 Fix available 6.0 MediumMay 25, 2026
• benoitc hackney CR/LF injection in query parameter in hackney CVE-2026-47075 Fix available 6.8 MediumMay 25, 2026
• benoitc hackney Unbounded body accumulation in HTTP/3 response loop in hackney CVE-2026-47077 Fix available 8.2 HighMay 25, 2026
• benoitc hackney SOCKS5 TLS upgrade ignores caller timeout in hackney CVE-2026-47071 Fix available 8.2 HighMay 25, 2026
• benoitc hackney CRLF injection in cookie domain/path options in hackney CVE-2026-47069 Fix available 2.1 LowMay 25, 2026
• benoitc hackney Infinite loop in Alt-Svc header parser in hackney CVE-2026-47066 Fix available 8.7 HighMay 25, 2026
• hackney Connection pool exhaustion in hackney CVE-2025-3864 Fix available 2.3 LowMay 28, 2025
• hackney Server-side Request Forgery (SSRF) in hackney CVE-2025-1211 Fix available 6.3 MediumFebruary 11, 2025