EEF-CVE-2026-47076 CVE-2026-47076 GHSA-pj7v-xfvx-wmjq
SSRF allowlist bypass via percent-encoded host in hackney
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.23%
- Chance of exploitation in the next 30 days. Higher than 13.74% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Fix
4.0.1- Upgrade hackney to this version or later
Description
Summary
Interpretation Conflict vulnerability in benoitc hackney allows Server Side Request Forgery. hackney_url:normalize/2 URL-decodes the host component after the URL has been parsed into a #hackney_url{} record. OTP's uri_string:parse/1 and inet:parse_address/1 do not decode percent-escapes in the host, so a URL such as http://%31%32%37%2E%30%2E%30%2E%31/ is seen by a caller's allowlist validator with host %31%32%37%2E%30%2E%30%2E%31 (not an IP address), which passes the allowlist check. hackney's normalizer then decodes the host to 127.0.0.1 and opens a TCP connection to loopback. Because hackney:request/5 always calls hackney_url:normalize/2 with no opt-out, every request that takes a binary or list URL is affected. The same technique reaches cloud instance metadata services (169.254.169.254), RFC1918 networks, and any admin interface listening on localhost.
This issue affects hackney: from 0.13.0 before 4.0.1.
Affected versions
Hex
| Package | Vulnerable | Fixed in |
|---|---|---|
| hackney | >= 0.13.0, < 4.0.1 |
4.0.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
hackney Hex → 4.0.1
- mix
{:hackney, "~> 4.0.1"} # then: mix deps.update hackney
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
- Attack vector
- Local
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- High
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 6.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-436: Interpretation Conflict
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
CWE-918: Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| EEF-CVE-2026-97200 Unbounded response body buffering and decompression in hackney | Not rated yet | Also affects hackney |
| EEF-CVE-2026-115693 Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney | Not rated yet | Also affects hackney |
| EEF-CVE-2026-113440 HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney | Not rated yet | Also affects hackney |
| EEF-CVE-2026-115700 SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney | Not rated yet | Also affects hackney |
| EEF-CVE-2026-112880 CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney | Not rated yet | Also affects hackney |
| EEF-CVE-2026-47073 Unbounded memory consumption in WebSocket client in hackney | High | Also affects hackney |
| EEF-CVE-2026-47067 Atom table exhaustion via unrecognized URL schemes in hackney | High | Also affects hackney |
| EEF-CVE-2026-47072 CRLF injection in WebSocket upgrade request in hackney | High | Also affects hackney |
Credits: Benoit Chesneau, Ganbagana, Jonatan Männchen / EEF
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor