hackney (Hex)
Advisories
28
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 4.9.0 or later clears every advisory below that has a fix.
Upgrade commands
mix
{:hackney, "~> 4.9.0"} # then: mix deps.update hackneyKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| EEF-CVE-2026-97200 Unbounded response body buffering and decompression in hackney |
Not rated yet EPSS 0.56% |
>= 2.0.0-beta.1, < 4.9.0 | 4.9.0 |
| EEF-CVE-2026-115693 Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney |
Not rated yet EPSS 0.27% |
>= 1.24.0, < 4.9.0 | 4.9.0 |
| EEF-CVE-2026-113440 HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney |
Not rated yet EPSS 0.31% |
>= 2.0.0, < 4.9.0 | 4.9.0 |
| EEF-CVE-2026-115700 SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney |
Not rated yet EPSS 0.14% |
>= 4.0.1, < 4.9.0 | 4.9.0 |
| EEF-CVE-2026-112880 CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney |
Not rated yet EPSS 0.19% |
>= 2.0.0, < 4.9.0 | 4.9.0 |
| GHSA-76v6-f83q-pxvh Duplicate Advisory: Hackney has an Allocation of Resources Without Limits or Throttling vulnerabilit Withdrawn |
High | >= 2.0.0, < 4.0.1 | 4.0.1 |
| EEF-CVE-2026-47073 Unbounded memory consumption in WebSocket client in hackney |
High EPSS 0.85% |
>= 2.0.0, < 4.0.1 | 4.0.1 |
| EEF-CVE-2026-47073 Unbounded memory consumption in WebSocket client in hackney |
High EPSS 0.85% |
>= 2.0.0, < 4.0.1 | 4.0.1 |
| EEF-CVE-2026-47067 Atom table exhaustion via unrecognized URL schemes in hackney |
High EPSS 0.75% |
>= 2.0.0, < 4.0.1 | 4.0.1 |
| EEF-CVE-2026-47067 Atom table exhaustion via unrecognized URL schemes in hackney |
High EPSS 0.75% |
>= 2.0.0, < 4.0.1 | 4.0.1 |
| EEF-CVE-2026-47072 CRLF injection in WebSocket upgrade request in hackney |
High EPSS 0.54% |
>= 2.0.0, < 4.0.1 | 4.0.1 |
| EEF-CVE-2026-47072 CRLF injection in WebSocket upgrade request in hackney |
High EPSS 0.54% |
>= 2.0.0, < 4.0.1 | 4.0.1 |
| EEF-CVE-2026-47076 SSRF allowlist bypass via percent-encoded host in hackney |
Medium EPSS 0.23% |
>= 0.13.0, < 4.0.1 | 4.0.1 |
| EEF-CVE-2026-47076 SSRF allowlist bypass via percent-encoded host in hackney |
Medium EPSS 0.23% |
>= 0.13.0, < 4.0.1 | 4.0.1 |
| EEF-CVE-2026-47070 HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney |
Medium EPSS 0.37% |
>= 3.1.1, < 4.0.1 | 4.0.1 |
| EEF-CVE-2026-47070 HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney |
Medium EPSS 0.37% |
>= 3.1.1, < 4.0.1 | 4.0.1 |
| EEF-CVE-2026-47075 CR/LF injection in query parameter in hackney |
High EPSS 0.48% |
>= 0.13.1, < 4.0.1 | 4.0.1 |
| EEF-CVE-2026-47075 CR/LF injection in query parameter in hackney |
High EPSS 0.48% |
< 4.0.1 | 4.0.1 |
| EEF-CVE-2026-47077 Unbounded body accumulation in HTTP/3 response loop in hackney |
High EPSS 0.70% |
>= 2.0.0, < 4.0.1 | 4.0.1 |
| EEF-CVE-2026-47077 Unbounded body accumulation in HTTP/3 response loop in hackney |
High EPSS 0.70% |
>= 2.0.0, < 4.0.1 | 4.0.1 |
| EEF-CVE-2026-47071 SOCKS5 TLS upgrade ignores caller timeout in hackney |
High EPSS 0.75% |
>= 0.10.0, < 4.0.1 | 4.0.1 |
| EEF-CVE-2026-47071 SOCKS5 TLS upgrade ignores caller timeout in hackney |
High EPSS 0.75% |
>= 0.10.0, < 4.0.1 | 4.0.1 |
| EEF-CVE-2026-47066 Infinite loop in Alt-Svc header parser in hackney |
High EPSS 0.75% |
>= 2.0.0-beta.1, < 4.0.1 | 4.0.1 |
| EEF-CVE-2026-47066 Infinite loop in Alt-Svc header parser in hackney |
High EPSS 0.75% |
>= 2.0.0, < 4.0.1 | 4.0.1 |
| EEF-CVE-2026-47069 CRLF injection in cookie domain/path options in hackney |
Medium EPSS 0.43% |
>= 0.9.0, < 4.0.1 | 4.0.1 |
| EEF-CVE-2026-47069 CRLF injection in cookie domain/path options in hackney |
Medium EPSS 0.43% |
>= 0.9.0, < 4.0.1 | 4.0.1 |
| GHSA-9fm9-hp7p-53mf Hackney fails to properly release HTTP connections to the pool |
Low EPSS 0.87% |
< 1.24.0 | 1.24.0 |
| GHSA-vq52-99r9-h5pw Server-side Request Forgery (SSRF) in hackney |
Medium EPSS 0.52% |
< 1.21.0 | 1.21.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor