CVE-2026-47076: benoitc hackney SSRF via percent-encoded host in normalize/2

Executive brief

Hackney, a popular Erlang HTTP client library, contains a vulnerability that allows attackers to bypass security filters designed to prevent Server-Side Request Forgery (SSRF). By using specially formatted web addresses, an attacker can trick the library into connecting to internal systems, such as private administrative interfaces or cloud metadata services, that should be inaccessible from the outside. This could lead to the exposure of sensitive internal data or unauthorized access to private infrastructure.

Technical details

A parser-differential SSRF vulnerability exists in hackney_url:normalize/2. While standard Erlang SSRF allowlists use uri_string:parse/1 and inet:parse_address/1 (which do not decode percent-encoded hostnames), hackney's normalize/2 function performs an internal urldecode/1 on the host component. An attacker can provide a URL with a percent-encoded IP address (e.g., http://%31%32%37%2E%30%2E%30%2E%31/) that bypasses initial validation but is later normalized by hackney to 127.0.0.1. This allows unauthenticated attackers to reach internal network targets, including loopback interfaces and cloud IMDS endpoints. The issue is fixed in version 4.0.1.

Affected products

• benoitc hackney >= 0.13.0, < 4.0.1

Timeline

• 2026-05-25: disclosed
• 2026-06-26: advisory
• 2026-06-26: patched: Fixed in version 4.0.1

References

• https://api.github.com/users/Ganbagana
• https://github.com/Ganbagana
• https://api.github.com/users/Ganbagana/gists%7B/gist_id%7D
• https://api.github.com/users/Ganbagana/repos
• https://avatars.githubusercontent.com/u/7631043?v=4
• https://api.github.com/users/Ganbagana/events%7B/privacy%7D