Server Side Request Forgery Vulnerability in Hackney by Benoit C.
CVE-2026-115700

6.9MEDIUM

Key Information:

Vendor

Benoitc

Status
Hackney
Vendor
CVE Published:
26 October 2026

What is CVE-2026-115700?

The hackney library by Benoit C. contains a Server Side Request Forgery vulnerability due to improper handling of percent-encoded bracketed IPv6 literals and IP addresses with trailing dots. This flaw allows attackers to bypass security measures in place and send requests to internal resources without proper authorization. This issue specifically affects hackney versions from 4.0.1 up to but not including 4.9.0, making certain forms of input permissible that should otherwise be restricted.

Affected Version(s)

hackney 4.0.1 < 4.9.0

hackney 452620a92ec1da2e6b4862a049a2a4f04b42068f

References

https://github.com/benoitc/hackney/releases/tag/4.9.0
vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-115700.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-115700
related

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eurico Nicacio
Eurico Nicacio
Benoit Chesneau
Jonatan Männchen / EEF
.