EEF-CVE-2026-47076

See a problem?
Please try reporting it to the source first.

Source

https://cna.erlef.org/osv/EEF-CVE-2026-47076.html

Import Source

https://cna.erlef.org/osv/EEF-CVE-2026-47076.json

JSON Data

https://api.osv.dev/v1/vulns/EEF-CVE-2026-47076

Aliases

CVE-2026-47076
GHSA-pj7v-xfvx-wmjq

Published

2026-05-25T14:00:46.707Z

Modified

2026-05-25T14:26:25.565686754Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator

Summary

SSRF allowlist bypass via percent-encoded host in hackney

Details

Summary

Interpretation Conflict vulnerability in benoitc hackney allows Server Side Request Forgery. hackneyurl:normalize/2 URL-decodes the host component after the URL has been parsed into a #hackneyurl{} record. OTP's uristring:parse/1 and inet:parseaddress/1 do not decode percent-escapes in the host, so a URL such as http://%31%32%37%2E%30%2E%30%2E%31/ is seen by a caller's allowlist validator with host %31%32%37%2E%30%2E%30%2E%31 (not an IP address), which passes the allowlist check. hackney's normalizer then decodes the host to 127.0.0.1 and opens a TCP connection to loopback. Because hackney:request/5 always calls hackney_url:normalize/2 with no opt-out, every request that takes a binary or list URL is affected. The same technique reaches cloud instance metadata services (169.254.169.254), RFC1918 networks, and any admin interface listening on localhost.

This issue affects hackney: from 0.13.0 before 4.0.1.

Database specific

{
    "cpe_ids": [
        "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
    ],
    "capec_ids": [
        "CAPEC-664"
    ],
    "cwe_ids": [
        "CWE-436",
        "CWE-918"
    ]
}

References

Credits

- Ganbagana - FINDER
- Benoit Chesneau - REMEDIATION_DEVELOPER
- Jonatan Männchen - ANALYST

Affected packages

Hex / hackney

Package

Name: hackney
Purl: pkg:hex/hackney

Affected ranges

Type: SEMVER
Events: Introduced

0.13.0

Fixed

4.0.1

Affected versions

0.*

0.13.1

0.14.0

0.14.1

0.14.2

0.14.3

0.15.0

0.15.2

1.*

1.0.1

1.0.2

1.0.5

1.0.6

1.1.0

1.2.0

1.3.0

1.3.1

1.3.2

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.4.10

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.7.0

1.7.1

1.8.0

1.8.2

1.8.3

1.8.4

1.8.5

1.8.6

1.9.0

1.10.0

1.10.1

1.11.0

1.12.0

1.12.1

1.13.0

1.14.0

1.14.2

1.14.3

1.15.0

1.15.1

1.15.2

1.16.0

1.17.0

1.17.1

1.17.2

1.17.3

1.17.4

1.18.0

1.18.1

1.18.2

1.19.0

1.19.1

1.20.0

1.20.1

1.21.0

1.22.0

1.23.0

1.24.0

1.24.1

1.25.0

2.*

2.0.0-beta.1

2.0.0

2.0.1

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.1.0

3.1.1

3.1.2

3.2.0

3.2.1

4.*

4.0.0

Database specific

source

"https://cna.erlef.org/osv/EEF-CVE-2026-47076.json"

Git / github.com/benoitc/hackney