CVE-2026-47070: benoitc hackney sensitive data exposure in HTTP/3 redirect handler

CVE-2026-47070 · Severity: medium · CVSS 6 · Published 2026-05-25

Hackney, a popular HTTP client library for Erlang, contains a security flaw in its HTTP/3 implementation. When the library is configured to follow redirects, it may inadvertently send sensitive information—such as login credentials, session cookies, and request data—to an untrusted third-party server if that server issues a redirect. This could allow an attacker to steal user sessions or private data by redirecting a legitimate request to a server they control.

Technologies: Benoit Chesneau Hackney. Vendors: Benoit Chesneau.

Quick answers

Is CVE-2026-47070 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47070 being exploited in the wild.
How severe is CVE-2026-47070?
Medium severity, with a CVSS score of 6, published 25 May 2026.
Which products and versions are affected?
Benoit Chesneau Hackney >= 3.1.1, < 4.0.1.
Is there a fix for CVE-2026-47070?
A patch was published on 2026-06-26: Fix confirmed in version 4.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47070 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-47070?
Check whether you run Benoit Chesneau Hackney at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the HTTP/3 redirect handler within `src/hackney_h3.erl` of the Hackney library. The `handle_redirect/11` function fails to verify if a redirect target's host matches the original request's origin before forwarding sensitive headers like `Authorization`, `Cookie`, and `Proxy-Authorization`. For 307 and 308 status codes, the original request body is also forwarded to the new destination. This occurs because the H3 client lacks the `maybe_strip_auth_on_redirect/2` logic present in the library's HTTP/1 implementation. Attackers can exploit this by providing a cross-origin `Location` header to capture credentials from clients with `follow_redirect` enabled. The issue is patched in version 4.0.1.

Affected products

  • benoitc hackney >= 3.1.1, < 4.0.1

Identifiers

  • CVE-2026-47070
  • GHSA-h73q-4w9q-82h4

Timeline

  • 2026-05-25: disclosed: Initial disclosure and NVD publication
  • 2026-06-26: advisory: GitHub Advisory published/reviewed
  • 2026-06-26: patched: Fix confirmed in version 4.0.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.