HA
Product
hackney
15
CVEs
0
On KEV
9.1
Max CVSS
5
New 30D
Severity mix
Critical 1High 8Medium 5Low 1
Watch
Add hackney to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-115700 New | 6.9 | Oct 26 | SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney Affected: 4.0.1 before 4.9.0; 452620a92ec1da2e6b4862a049a2a4f04b42068f before f19561a0b422376348c91537e51377ab7325f4ee |
| CVE-2026-47076 | 6.5 | May 25 | SSRF allowlist bypass via percent-encoded host in hackney Affected: 0.13.0 before 4.0.1; 4d725507588942fd00efca15b86da3273656510a before 452620a92ec1da2e6b4862a049a2a4f04b42068f |
| CVE-2026-47070 | 6.1 | May 25 | HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney Affected: 3.1.1 before 4.0.1; e61b7d04b7826847e1efe614106ef4d580c78eab before c58d5b50bade146360b85caf3dc8065807b08246 |
| CVE-2026-113440 New | 6.0 | Oct 26 | HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney Affected: 2.0.0 before 4.9.0; 8f944559bdb83da60b5c06f6cf6d842591278364 before 6548384b22ea196023a1963e2967d5715b6d9564 |
| CVE-2026-47069 | 5.3 | May 25 | CRLF injection in cookie domain/path options in hackney Affected: 0.9.0 before 4.0.1; 602d5c7f2ea4acbc83ed75230655d935a0750ebc before 8e02b99c28aea1b3fa2ddc0e66f51fe5bb0ac540 |
Showing 5