PT-2026-43067 · Hackney · Hackney

Benoit Chesneau + 2 · Published 2026-05-25 · Updated 2026-06-26 · CVE-2026-47070

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions benoitc hackney versions 3.1.1 through 4.0.0

Description A sensitive data exposure issue exists where the HTTP/3 redirect handler in src/hackney h3.erl passes original request headers to a redirect target without performing cross-origin checks. If a client makes an HTTP/3 request with follow redirect enabled and includes Authorization or Cookie headers, a server responding with a 3xx redirect to a different host will cause the client to forward these credentials verbatim to the new origin. This occurs because hackney h3.erl lacks the protection provided by the maybe strip auth on redirect() function found in the main hackney.erl module.

Recommendations Update to version 4.0.1.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-47070

GHSA-H73Q-4W9Q-82H4

Affected Products

Hackney

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47070.json · Exploit
• 🔥 https://github.com/benoitc/hackney/security/advisories/GHSA-h73q-4w9q-82h4 · Exploit
• https://github.com/benoitc/hackney/commit/c58d5b50bade146360b85caf3dc8065807b08246 · Patch
• https://cna.erlef.org/cves/CVE-2026-47070.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-47070 · Security Note
• https://osv.dev/vulnerability/CVE-2026-47070 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h73q-4w9q-82h4 · Vendor Advisory
• https://github.com/benoitc/hackney · Note
• https://osv.dev/vulnerability/EEF-CVE-2026-47070 · Vendor Advisory, Patch
• https://t.me/cveNotify/164840 · Telegram Post
• https://github.com · Note
• https://twitter.com/dailycve/status/2059688153154245092 · Twitter Post
• https://hex.pm/packages/hackney · Note
• https://repo.hex.pm · Note