Server-side Request Forgery in Hackney by Hex

CVE-2025-1211

What is CVE-2025-1211?

Hackney, a popular HTTP client library, is susceptible to Server-side Request Forgery (SSRF) which arises due to incorrect URL parsing by its URI module. The issue occurs when the library inappropriately determines the target host, leading to potential unauthorized access to server resources. For instance, an input URL like 'http://127.0.0.1?@127.2.2.2/' can be misinterpreted, allowing attackers to exploit host verification weaknesses. It is crucial for developers relying on URL functions to ensure secure configurations to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References