Benoitc Hackney vulnerabilities

CVE-2018-1000007 [CRITICAL] CWE-601 CVE-2018-1000007: libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location

CVE-2026-47073 [HIGH] CWE-400 CVE-2026-47073: Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Floodin Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The WebSocket client in src/hackney_ws.erl imposes no upper bound on memory consumption in three code paths. First, read_handshake_response/3 accumulates received bytes into a growing buffer with no size cap; the per-receive timeout resets on every c

CVE-2026-47075 [HIGH] CWE-93 CVE-2026-47075: Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Split Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r) or line feed (\n) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar defined in RFC 3986 Section 3.4 must be percent-encoded, bu

CVE-2026-47074 [HIGH] CWE-295 Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM ### Summary `hackney_h3:await_response_loop/6` in `src/hackney_h3.erl` accumulates the HTTP/3 response body in memory without any size cap. The `after Timeout` clause is a per-message inactivity timer, not a wall-clock deadline: every received `stream_data` chunk, housekeeping `select` message, or `sett

CVE-2026-47072 [HIGH] CWE-93 CVE-2026-47072: Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Request/Response Splitting. The WebSocket upgrade code in src/hackney_ws.erl copies the host, path, headers (ExtraHeaders), and protocols options from the caller-supplied opts map into the internal #ws_data{} record in init/1 and then splices them

CVE-2026-47071 [HIGH] CWE-400 CVE-2026-47071: Uncontrolled Resource Consumption vulnerability in benoitc hackney allows Flooding. The SOCKS5 trans Uncontrolled Resource Consumption vulnerability in benoitc hackney allows Flooding. The SOCKS5 transport in src/hackney_socks5.erl correctly applies the caller-supplied timeout to the SOCKS5 negotiation phase, but then upgrades the connection to TLS using the two-argument form ssl:connect/2, which defaults to an infinite timeout. The Timeout value is

CVE-2026-47067 [HIGH] CWE-770 CVE-2026-47067: Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Floodin Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackney_url.erl converts every unrecognized URL scheme to a permanent BEAM atom via binary_to_atom/2. BEAM atoms are never garbage-collected and the atom table defaults to a hard limit of 1,048,576 entries. An attacker who can s

CVE-2026-47066 [HIGH] CWE-835 CVE-2026-47066: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in benoitc hackney allows Exces Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in benoitc hackney allows Excessive Allocation. The Alt-Svc response header parser in src/hackney_altsvc.erl does not guarantee forward progress. When parse_token/2 receives a non-token, non-whitespace, non-comma byte (e.g. !, @, =, ;), it returns the input unchanged. skip_comma/1 al

CVE-2026-47077 [HIGH] CWE-400 CVE-2026-47077: Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Floodin Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. hackney_h3:await_response_loop/6 accumulates the HTTP/3 response body in memory without any size cap. The after Timeout clause is a per-message inactivity timer that resets on every received chunk, housekeeping message, or settings frame — it is not

CVE-2026-47076 [MEDIUM] CWE-436 CVE-2026-47076: Interpretation Conflict vulnerability in benoitc hackney allows Server Side Request Forgery. hackney Interpretation Conflict vulnerability in benoitc hackney allows Server Side Request Forgery. hackney_url:normalize/2 URL-decodes the host component after the URL has been parsed into a #hackney_url{} record. OTP's uri_string:parse/1 and inet:parse_address/1 do not decode percent-escapes in the host, so a URL such as http://%31%32%37%2E%30%2E%30%2E%3

CVE-2026-47069 [MEDIUM] CWE-93 CVE-2026-47069: Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Response Splitting. The hackney_cookie:setcookie/3 function in src/hackney_cookie.erl validates the Name and Value arguments against CRLF and control characters, but concatenates the domain and path options verbatim into the output iolist with no

CVE-2026-47070 [MEDIUM] CVE-2026-47070: Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. Th Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackney_h3.erl passes the original request headers unchanged to the redirect target without performing any cross-origin check. When a client issues an HTTP/3 request with follow_redirect enabled and includes Authorization or C