CVE-2026-47070

MEDIUM EPSS 26.7%
Published May 25, 20261mo ago · Modified Jun 17, 20261w ago
6.0 CVSS 4.0
Medium
Find Similar
Published May 25, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago

Description

Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackney_h3.erl passes the original request headers unchanged to the redirect target without performing any cross-origin check. When a client issues an HTTP/3 request with follow_redirect enabled and includes Authorization or Cookie headers, a server responding with a 3xx redirect to a different host will cause the client to forward those credentials verbatim to the new origin. The main hackney.erl module has maybe_strip_auth_on_redirect/2 (guarded by the location_trusted option) to address CVE-2018-1000007, but hackney_h3.erl is missing this protection entirely. This issue affects hackney: from 3.1.1 before 4.0.1.

CVSS Details

Base Score
6.0
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction P
Scope X

Threat Intelligence

EPSS Exploit Probability
26.7% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-601

Affected Products 1

VendorProductVersionRange
benoitchackney*≥3.1.1  –  <4.0.1

References 4

  • cna.erlef.org https://cna.erlef.org/cves/CVE-2026-47070.html
    PatchThird Party Advisory
  • github.com https://github.com/benoitc/hackney/commit/c58d5b50bade146360b85caf3dc8065807b08246
    Patch
  • github.com https://github.com/benoitc/hackney/security/advisories/GHSA-h73q-4w9q-82h4
    ExploitPatchVendor Advisory
  • osv.dev https://osv.dev/vulnerability/EEF-CVE-2026-47070
    PatchThird Party Advisory

Remediation

  • cna.erlef.org https://cna.erlef.org/cves/CVE-2026-47070.html
    PatchThird Party Advisory
  • github.com https://github.com/benoitc/hackney/commit/c58d5b50bade146360b85caf3dc8065807b08246
    Patch
  • github.com https://github.com/benoitc/hackney/security/advisories/GHSA-h73q-4w9q-82h4
    ExploitPatchVendor Advisory
  • osv.dev https://osv.dev/vulnerability/EEF-CVE-2026-47070
    PatchThird Party Advisory