Skip to content
Log inStart free trial

GHSA-vq52-99r9-h5pw CVE-2025-1211

Server-side Request Forgery (SSRF) in hackney

Medium Hex
Severity
0.0 / 10
Medium · CVSS 4.0
Exploit chance (EPSS)
0.52%
Chance of exploitation in the next 30 days. Higher than 44.49% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-918 Server-Side Request Forgery (SSRF)
Fix
1.21.0
Upgrade hackney to this version or later

Description

Versions of the package hackney from 0.0.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI built-in module and hackey. Given the URL http://127.0.0.1?@127.2.2.2/, the URI function will parse and see the host as 127.0.0.1 (which is correct), and hackney will refer the host as 127.2.2.2/. This vulnerability can be exploited when users rely on the URL function for host checking.

Affected versions

Hex

PackageVulnerableFixed in
hackney
< 1.21.0
1.21.0

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

hackney Hex → 1.21.0

mix
{:hackney, "~> 1.21.0"} # then: mix deps.update hackney

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L/E:P

Attack vector
Network
Attack complexity
Low
Attack requirements
Present
Privileges required
None
User interaction
None
Confidentiality (vulnerable system)
Low
Integrity (vulnerable system)
None
Availability (vulnerable system)
None
Confidentiality (subsequent systems)
Low
Integrity (subsequent systems)
Low
Availability (subsequent systems)
Low
Exploit maturity
Proof of concept

CVSS 3.1 6.5

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

Weakness

CWE-918: Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
EEF-CVE-2026-97200
Unbounded response body buffering and decompression in hackney
Not rated yet Also affects hackney
EEF-CVE-2026-115693
Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney
Not rated yet Also affects hackney
EEF-CVE-2026-113440
HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney
Not rated yet Also affects hackney
EEF-CVE-2026-115700
SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney
Not rated yet Also affects hackney
EEF-CVE-2026-112880
CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney
Not rated yet Also affects hackney
EEF-CVE-2026-47073
Unbounded memory consumption in WebSocket client in hackney
High Also affects hackney
EEF-CVE-2026-47067
Atom table exhaustion via unrecognized URL schemes in hackney
High Also affects hackney
EEF-CVE-2026-47072
CRLF injection in WebSocket upgrade request in hackney
High Also affects hackney
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor