HA
Product
hackney
15
CVEs
0
On KEV
9.1
Max CVSS
5
New 30D
Severity mix
Critical 1High 8Medium 5Low 1
Watch
Add hackney to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-115693 New | 9.1 | Oct 26 | Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney Affected: 1.24.0 before 4.9.0; d8a9afcf5c3849904274e2eba1df56c63d1a1a0c before 915eb5737e9c489d8fc22eec8cdae30e9b027be4 |
| CVE-2026-97200 New | 8.2 | Oct 26 | Unbounded response body buffering and decompression in hackney Affected: 2.0.0-beta.1 before 4.9.0; dc41b79339ca0c41e16d3f2dd17172bc2de855d6 before 493e8bf83a391548e5101792276ab3fc428fa76c |
| CVE-2026-47073 | 7.5 | May 25 | Unbounded memory consumption in WebSocket client in hackney Affected: 2.0.0 before 4.0.1; 690cecaf236fba49526da404a5bc889a24367a3e before ce0109e2970ace6e20ff29bae9d05c3ac22ec6dc |
| CVE-2026-47067 | 7.5 | May 25 | Atom table exhaustion via unrecognized URL schemes in hackney Affected: 2.0.0 before 4.0.1; d9713695c0d99855d12c73fd8a0b4be0543950c4 before 31f6f0e27e096ad88743dfded4f030a3ee74972e |
| CVE-2026-47072 | 7.5 | May 25 | CRLF injection in WebSocket upgrade request in hackney Affected: 2.0.0 before 4.0.1; 690cecaf236fba49526da404a5bc889a24367a3e before 52310ca807e7b48441ba0e9129171f535313fdd1 |
| CVE-2026-47075 | 7.5 | May 25 | CR/LF injection in query parameter in hackney Affected: 0.13.1 before 4.0.1; 8bb1a359a81ae58567c84f8d24564e9742e6f2bd before ca73dd0aba0ed557449c18288bf07241671a43c9 |
| CVE-2026-47077 | 7.5 | May 25 | Unbounded body accumulation in HTTP/3 response loop in hackney Affected: 2.0.0 before 4.0.1; 0334af206d5099fdf510ed9eda18e34396f065ad before 3d25f9fea26c90609de9d64366fedfe5065413bc |
| CVE-2026-47071 | 7.5 | May 25 | SOCKS5 TLS upgrade ignores caller timeout in hackney Affected: 0.10.0 before 4.0.1; 34cdbd1d20a282aacc286a89327465a3925b4c5d before 5ccdab725c561a6f03d05a51f2d0664f98236dae |
| CVE-2026-47066 | 7.5 | May 25 | Infinite loop in Alt-Svc header parser in hackney Affected: 2.0.0-beta.1 before 4.0.1; 408e5fe20302226ea8c74dde2bcbd452d712b5b2 before e548aba1f97ffa3f4750da7b772998fb78c01894 |
| CVE-2026-115700 New | 6.9 | Oct 26 | SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney Affected: 4.0.1 before 4.9.0; 452620a92ec1da2e6b4862a049a2a4f04b42068f before f19561a0b422376348c91537e51377ab7325f4ee |
| CVE-2026-47076 | 6.5 | May 25 | SSRF allowlist bypass via percent-encoded host in hackney Affected: 0.13.0 before 4.0.1; 4d725507588942fd00efca15b86da3273656510a before 452620a92ec1da2e6b4862a049a2a4f04b42068f |
| CVE-2026-47070 | 6.1 | May 25 | HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney Affected: 3.1.1 before 4.0.1; e61b7d04b7826847e1efe614106ef4d580c78eab before c58d5b50bade146360b85caf3dc8065807b08246 |
| CVE-2026-113440 New | 6.0 | Oct 26 | HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney Affected: 2.0.0 before 4.9.0; 8f944559bdb83da60b5c06f6cf6d842591278364 before 6548384b22ea196023a1963e2967d5715b6d9564 |
| CVE-2026-47069 | 5.3 | May 25 | CRLF injection in cookie domain/path options in hackney Affected: 0.9.0 before 4.0.1; 602d5c7f2ea4acbc83ed75230655d935a0750ebc before 8e02b99c28aea1b3fa2ddc0e66f51fe5bb0ac540 |
| CVE-2026-112880 New | 2.1 | Oct 26 | CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney Affected: 2.0.0 before 4.9.0; 5df5a74a2817d5b12880d217db33253ff1fae1b5 before 5ee7d7d19eba27e774667d472feb1e93a08af7f9 |
Showing 15