Interpretation Conflict Vulnerability in Hackney by Benoit C

CVE-2026-47076

What is CVE-2026-47076?

An interpretation conflict vulnerability in Hackney allows for server-side request forgery (SSRF). The issue arises due to the normalization process of URLs, where the host component is decoded improperly after the URL is parsed. This flaw enables an attacker to bypass whitelisting checks, exposing server resources to potential unauthorized access. Specifically, certain URLs containing percent-encoded addresses are parsed inaccurately, facilitating access to sensitive services, including cloud instance metadata and localhost interfaces. This vulnerability affects all requests using Hackney from versions 0.13.0 to just before 4.0.1.

References