CVE-2026-47076: benoitc hackney SSRF via percent-encoded host in normalize/2

CVE-2026-47076 · Severity: medium · CVSS 6.9 · Published 2026-05-25

Hackney, a popular Erlang HTTP client library, contains a vulnerability that allows attackers to bypass security filters designed to prevent Server-Side Request Forgery (SSRF). By using specially formatted web addresses, an attacker can trick the library into connecting to internal systems, such as private administrative interfaces or cloud metadata services, that should be inaccessible from the outside. This could lead to the exposure of sensitive internal data or unauthorized access to private infrastructure.

Technologies: Benoit Chesneau Hackney. Vendors: Benoit Chesneau.

Quick answers

Is CVE-2026-47076 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47076 being exploited in the wild.
How severe is CVE-2026-47076?
Medium severity, with a CVSS score of 6.9, published 25 May 2026.
Which products and versions are affected?
Benoit Chesneau Hackney >= 0.13.0, < 4.0.1.
Is there a fix for CVE-2026-47076?
A patch was published on 2026-06-26: Fixed in version 4.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47076 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-47076?
Check whether you run Benoit Chesneau Hackney at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A parser-differential SSRF vulnerability exists in hackney_url:normalize/2. While standard Erlang SSRF allowlists use uri_string:parse/1 and inet:parse_address/1 (which do not decode percent-encoded hostnames), hackney's normalize/2 function performs an internal urldecode/1 on the host component. An attacker can provide a URL with a percent-encoded IP address (e.g., http://%31%32%37%2E%30%2E%30%2E%31/) that bypasses initial validation but is later normalized by hackney to 127.0.0.1. This allows unauthenticated attackers to reach internal network targets, including loopback interfaces and cloud IMDS endpoints. The issue is fixed in version 4.0.1.

Affected products

  • benoitc hackney >= 0.13.0, < 4.0.1

Identifiers

  • CVE-2026-47076
  • GHSA-pj7v-xfvx-wmjq

Timeline

  • 2026-05-25: disclosed
  • 2026-06-26: advisory
  • 2026-06-26: patched: Fixed in version 4.0.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.