CVE-2026-47070 Details
Description
Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackney_h3.erl passes the original request headers unchanged to the redirect target without performing any cross-origin check. When a client issues an HTTP/3 request with follow_redirect enabled and includes Authorization or Cookie headers, a server responding with a 3xx redirect to a different host will cause the client to forward those credentials verbatim to the new origin. The main hackney.erl module has maybe_strip_auth_on_redirect/2 (guarded by the location_trusted option) to address CVE-2018-1000007, but hackney_h3.erl is missing this protection entirely. This issue affects hackney: from 3.1.1 before 4.0.1.
A sensitive data exposure vulnerability has been identified in the benoitc hackney HTTP client, specifically in versions 3.1.1 prior to 4.0.1. The issue arises in the HTTP/3 redirect handler, which forwards original request headers, including Authorization and Cookie, to a redirect target without cross-origin checks. This flaw allows an attacker to intercept credentials when a client follows a redirect to a different host. The vulnerability exists because the HTTP/3 client lacks the same protections as the HTTP/1.1 client, which can strip sensitive headers before cross-origin redirects.
Users can upgrade to hackney version 4.0.1, which addresses this vulnerability by stripping credentials from redirect headers when the target origin differs from the original, unless the location_trusted option is enabled.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/benoitc/hackney/security/advisories/GHSA-h73q-4w9q-82h4 | CISA-ADP | ExploitPatchVendor Advisory |
| https://cna.erlef.org/cves/CVE-2026-47070.html | EEF | PatchThird Party Advisory |
| https://github.com/benoitc/hackney/commit/c58d5b50bade146360b85caf3dc8065807b08246 | EEF | Patch |
| https://github.com/benoitc/hackney/security/advisories/GHSA-h73q-4w9q-82h4 | EEF | ExploitPatchVendor Advisory |
| https://osv.dev/vulnerability/EEF-CVE-2026-47070 | EEF | PatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | EEF |
Affected Products
| Product | Versions |
|---|---|
| benoitc hackney | >= 3.1.1, < 4.0.1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | Initial Analysis | [email protected] |
| May 26, 2026 | CVE Modified | CISA-ADP |
| May 25, 2026 | New CVE Received | EEF |