benoitc has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was October 2026 with 5. The median CVSS is 6.9 (medium), with 1 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.9
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Worst active — by depth score
CVE-2026-115693Critical· 9.1Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney50CVE-2026-97200High· 8.2Unbounded response body buffering and decompression in hackney45CVE-2026-115700Medium· 6.9SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney38CVE-2026-113440Medium· 6.0HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney33CVE-2026-112880Low· 2.1CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney12
benoitc vulnerabilities
CVEs affecting benoitc, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-113440Medium· 6.0HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney
Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_red…
CVE-2026-112880Low· 2.1CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback returns. After a…
CVE-2026-115693Critical· 9.1Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney
Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. ha…
CVE-2026-115700Medium· 6.9SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney
Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%…
CVE-2026-97200High· 8.2Unbounded response body buffering and decompression in hackney
Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hack…