Packages
hackney
4.4.5
4.4.5
4.4.3
4.4.2
4.4.1
4.4.0
4.3.0
4.2.3
4.2.2
4.2.1
4.2.0
4.1.0
4.0.3
4.0.2
4.0.1
4.0.0
3.2.1
3.2.0
3.1.2
3.1.1
3.1.0
3.0.3
3.0.2
3.0.1
3.0.0
retired
2.0.1
2.0.0
2.0.0-beta.1
1.25.0
1.24.1
1.24.0
1.23.0
1.22.0
1.21.0
1.20.1
1.20.0
1.19.1
1.19.0
1.18.2
1.18.1
1.18.0
1.17.4
1.17.3
1.17.2
1.17.1
1.17.0
1.16.0
1.15.2
1.15.1
1.15.0
1.14.3
1.14.2
1.14.0
1.13.0
1.12.1
1.12.0
1.11.0
1.10.1
1.10.0
1.9.0
1.8.6
1.8.5
1.8.4
1.8.3
1.8.2
1.8.0
1.7.1
1.7.0
1.6.6
retired
1.6.5
1.6.4
retired
1.6.3
1.6.2
1.6.1
1.6.0
1.5.7
1.5.6
1.5.5
1.5.4
1.5.3
1.5.2
1.5.1
1.5.0
1.4.10
1.4.8
1.4.7
1.4.6
1.4.5
1.4.4
1.4.3
1.4.2
1.4.1
1.4.0
1.3.2
1.3.1
1.3.0
1.2.0
1.1.0
1.0.6
1.0.5
1.0.2
1.0.1
0.15.2
0.15.0
0.14.3
0.14.2
0.14.1
0.14.0
0.13.1
Simple HTTP client with HTTP/1.1, HTTP/2, and HTTP/3 support
Current section
12 Advisories
Jump to
Current section
12 Advisories
Atom table exhaustion via unrecognized URL schemes in hackney
CVSS
?
The Common Vulnerability Scoring System (CVSS) is an open standard for rating the severity of security vulnerabilities on a scale from 0.0 to 10.0.
8.7 / 10.0
High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Versions
>= 2.0.0 and < 4.0.1
References
- https://cna.erlef.org/cves/CVE-2026-47067.html
- https://github.com/benoitc/hackney
- https://github.com/benoitc/hackney/commit/31f6f0e27e096ad88743dfded4f030a3ee74972e
- https://github.com/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62
- https://hex.pm/packages/hackney
- https://nvd.nist.gov/vuln/detail/CVE-2026-47067
- https://osv.dev/vulnerability/EEF-CVE-2026-47067
Unbounded memory consumption in WebSocket client in hackney
CVSS
?
The Common Vulnerability Scoring System (CVSS) is an open standard for rating the severity of security vulnerabilities on a scale from 0.0 to 10.0.
8.7 / 10.0
High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Versions
>= 2.0.0 and < 4.0.1
References
- https://cna.erlef.org/cves/CVE-2026-47073.html
- https://github.com/benoitc/hackney
- https://github.com/benoitc/hackney/commit/ce0109e2970ace6e20ff29bae9d05c3ac22ec6dc
- https://github.com/benoitc/hackney/security/advisories/GHSA-q8jg-fgj4-fphf
- https://hex.pm/packages/hackney
- https://nvd.nist.gov/vuln/detail/CVE-2026-47073
- https://osv.dev/vulnerability/EEF-CVE-2026-47073
CRLF injection in WebSocket upgrade request in hackney
CVSS
?
The Common Vulnerability Scoring System (CVSS) is an open standard for rating the severity of security vulnerabilities on a scale from 0.0 to 10.0.
6.9 / 10.0
Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N
Affected Versions
>= 2.0.0 and < 4.0.1
References
- https://cna.erlef.org/cves/CVE-2026-47072.html
- https://github.com/benoitc/hackney
- https://github.com/benoitc/hackney/commit/52310ca807e7b48441ba0e9129171f535313fdd1
- https://github.com/benoitc/hackney/security/advisories/GHSA-f9vr-g2g2-x9fg
- https://hex.pm/packages/hackney
- https://nvd.nist.gov/vuln/detail/CVE-2026-47072
- https://osv.dev/vulnerability/EEF-CVE-2026-47072
CR/LF injection in query parameter in hackney
CVSS
?
The Common Vulnerability Scoring System (CVSS) is an open standard for rating the severity of security vulnerabilities on a scale from 0.0 to 10.0.
6.8 / 10.0
Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
Affected Versions
< 4.0.1
References
- https://cna.erlef.org/cves/CVE-2026-47075.html
- https://github.com/benoitc/hackney
- https://github.com/benoitc/hackney/commit/ca73dd0aba0ed557449c18288bf07241671a43c9
- https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf
- https://hex.pm/packages/hackney
- https://nvd.nist.gov/vuln/detail/CVE-2026-47075
- https://osv.dev/vulnerability/EEF-CVE-2026-47075
Unbounded body accumulation in HTTP/3 response loop in hackney
CVSS
?
The Common Vulnerability Scoring System (CVSS) is an open standard for rating the severity of security vulnerabilities on a scale from 0.0 to 10.0.
8.2 / 10.0
High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Versions
>= 2.0.0 and < 4.0.1
References
- https://cna.erlef.org/cves/CVE-2026-47077.html
- https://github.com/benoitc/hackney
- https://github.com/benoitc/hackney/commit/3d25f9fea26c90609de9d64366fedfe5065413bc
- https://github.com/benoitc/hackney/security/advisories/GHSA-jq4m-q6p2-8gwc
- https://github.com/ex-aws/ex_aws_sns/security/advisories/GHSA-8jgf-23q5-x7xx
- https://hex.pm/packages/hackney
- https://nvd.nist.gov/vuln/detail/CVE-2026-47077
- https://osv.dev/vulnerability/EEF-CVE-2026-47077
HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney
CVSS
?
The Common Vulnerability Scoring System (CVSS) is an open standard for rating the severity of security vulnerabilities on a scale from 0.0 to 10.0.
6.0 / 10.0
Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected Versions
>= 3.1.1 and < 4.0.1
References
- https://cna.erlef.org/cves/CVE-2026-47070.html
- https://github.com/benoitc/hackney
- https://github.com/benoitc/hackney/commit/c58d5b50bade146360b85caf3dc8065807b08246
- https://github.com/benoitc/hackney/security/advisories/GHSA-h73q-4w9q-82h4
- https://hex.pm/packages/hackney
- https://nvd.nist.gov/vuln/detail/CVE-2026-47070
- https://osv.dev/vulnerability/EEF-CVE-2026-47070
SSRF allowlist bypass via percent-encoded host in hackney
CVSS
?
The Common Vulnerability Scoring System (CVSS) is an open standard for rating the severity of security vulnerabilities on a scale from 0.0 to 10.0.
6.9 / 10.0
Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Affected Versions
>= 0.13.0 and < 4.0.1
References
- https://cna.erlef.org/cves/CVE-2026-47076.html
- https://github.com/benoitc/hackney
- https://github.com/benoitc/hackney/commit/452620a92ec1da2e6b4862a049a2a4f04b42068f
- https://github.com/benoitc/hackney/security/advisories/GHSA-pj7v-xfvx-wmjq
- https://hex.pm/packages/hackney
- https://nvd.nist.gov/vuln/detail/CVE-2026-47076
- https://osv.dev/vulnerability/EEF-CVE-2026-47076
CRLF injection in cookie domain/path options in hackney
CVSS
?
The Common Vulnerability Scoring System (CVSS) is an open standard for rating the severity of security vulnerabilities on a scale from 0.0 to 10.0.
2.1 / 10.0
Low
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Affected Versions
>= 0.9.0 and < 4.0.1
References
- https://cna.erlef.org/cves/CVE-2026-47069.html
- https://github.com/benoitc/hackney
- https://github.com/benoitc/hackney/commit/8e02b99c28aea1b3fa2ddc0e66f51fe5bb0ac540
- https://github.com/benoitc/hackney/security/advisories/GHSA-mp55-p8c9-rfw2
- https://hex.pm/packages/hackney
- https://nvd.nist.gov/vuln/detail/CVE-2026-47069
- https://osv.dev/vulnerability/EEF-CVE-2026-47069
SOCKS5 TLS upgrade ignores caller timeout in hackney
CVSS
?
The Common Vulnerability Scoring System (CVSS) is an open standard for rating the severity of security vulnerabilities on a scale from 0.0 to 10.0.
8.2 / 10.0
High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Versions
>= 0.10.0 and < 4.0.1
References
- https://cna.erlef.org/cves/CVE-2026-47071.html
- https://github.com/benoitc/hackney
- https://github.com/benoitc/hackney/commit/5ccdab725c561a6f03d05a51f2d0664f98236dae
- https://github.com/benoitc/hackney/security/advisories/GHSA-gp9c-pm5m-5cxr
- https://hex.pm/packages/hackney
- https://nvd.nist.gov/vuln/detail/CVE-2026-47071
- https://osv.dev/vulnerability/EEF-CVE-2026-47071
Infinite loop in Alt-Svc header parser in hackney
CVSS
?
The Common Vulnerability Scoring System (CVSS) is an open standard for rating the severity of security vulnerabilities on a scale from 0.0 to 10.0.
8.7 / 10.0
High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Versions
>= 2.0.0-beta.1 and < 4.0.1
>= 2.0.0 and < 4.0.1
References
- https://cna.erlef.org/cves/CVE-2026-47066.html
- https://github.com/benoitc/hackney
- https://github.com/benoitc/hackney/commit/e548aba1f97ffa3f4750da7b772998fb78c01894
- https://github.com/benoitc/hackney/security/advisories/GHSA-6cp8-v795-jr2j
- https://hex.pm/packages/hackney
- https://nvd.nist.gov/vuln/detail/CVE-2026-47066
- https://osv.dev/vulnerability/EEF-CVE-2026-47066
GHSA-9fm9-hp7p-53mf
CVE-2025-3864
Hackney fails to properly release HTTP connections to the pool
CVSS
?
The Common Vulnerability Scoring System (CVSS) is an open standard for rating the severity of security vulnerabilities on a scale from 0.0 to 10.0.
2.3 / 10.0
Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected Versions
< 1.24.0
GHSA-vq52-99r9-h5pw
CVE-2025-1211
Server-side Request Forgery (SSRF) in hackney
CVSS
?
The Common Vulnerability Scoring System (CVSS) is an open standard for rating the severity of security vulnerabilities on a scale from 0.0 to 10.0.
2.9 / 10.0
Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L/E:P
Affected Versions
< 1.21.0
References
- https://gist.github.com/snoopysecurity/996de09ec0cfd0ebdcfdda8ff515deb1
- https://github.com/benoitc/hackney
- https://github.com/benoitc/hackney/commit/9594ce58fabd32cd897fc28fae937694515a3d4a
- https://github.com/benoitc/hackney/releases/tag/1.21.0
- https://nvd.nist.gov/vuln/detail/CVE-2025-1211
- https://security.snyk.io/vuln/SNYK-HEX-HACKNEY-6516131
- https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf
Checksum
Dependency Config
mix.exs
rebar.config
Gleam
erlang.mk
Package Details
Downloads
Last 30 days,
all versions
this version
13 977
yesterday
46 163
last 7 days
250 807
all time
169 265 572