Malicious code in hackney.core.jwt (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in hackney.core.enums (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7448 Malicious code in hackney.core.enums (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7449 Malicious code in hackney.core.jwt (NuGet)

--- -= Per source details. Do not edit below this line.=-...

CVE-2026-47073

creationtimestamp| type| source ---|---|--- 2026-06-27 00:35:56+00:00| published-proof-of-concept| https://github.com/benoitc/hackney/security/advisories/GHSA-q8jg-fgj4-fphf...

CVE-2026-47067

creationtimestamp| type| source ---|---|--- 2026-06-27 00:35:54+00:00| published-proof-of-concept| https://github.com/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62...

CVE-2026-47069

creationtimestamp| type| source ---|---|--- 2026-06-26 22:35:20+00:00| published-proof-of-concept| https://github.com/benoitc/hackney/security/advisories/GHSA-mp55-p8c9-rfw2...

CVE-2026-47066

creationtimestamp| type| source ---|---|--- 2026-06-26 22:35:17+00:00| published-proof-of-concept| https://github.com/benoitc/hackney/security/advisories/GHSA-6cp8-v795-jr2j...

CVE-2026-47071

creationtimestamp| type| source ---|---|--- 2026-06-26 22:35:15+00:00| published-proof-of-concept| https://github.com/benoitc/hackney/security/advisories/GHSA-gp9c-pm5m-5cxr...

CVE-2026-47070

creationtimestamp| type| source ---|---|--- 2026-06-26 22:35:10+00:00| published-proof-of-concept| https://github.com/benoitc/hackney/security/advisories/GHSA-h73q-4w9q-82h4...

CVE-2026-47075

creationtimestamp| type| source ---|---|--- 2026-06-26 22:35:05+00:00| published-proof-of-concept| https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf...

CVE-2026-47072

creationtimestamp| type| source ---|---|--- 2026-06-26 22:35:02+00:00| published-proof-of-concept| https://github.com/benoitc/hackney/security/advisories/GHSA-f9vr-g2g2-x9fg...

Hackney vulnerable to atom-table exhaustion via unrecognized URL schemes

Summary CVE-2026-47067 is an atom table exhaustion vulnerability CWE-770 in hackney's URL parser src/hackneyurl.erl. hackneyurl:parseurl/1 converts every URL scheme it encounters into a BEAM atom via binarytoatom/2. Because BEAM atoms are never garbage-collected and the atom table has a hard limi...

EUVD-2026-31691

Hackney vulnerable to atom-table exhaustion via unrecognized URL schemes...

GHSA-9653-RCFR-5C62 Hackney vulnerable to atom-table exhaustion via unrecognized URL schemes

Summary CVE-2026-47067 is an atom table exhaustion vulnerability CWE-770 in hackney's URL parser src/hackneyurl.erl. hackneyurl:parseurl/1 converts every URL scheme it encounters into a BEAM atom via binarytoatom/2. Because BEAM atoms are never garbage-collected and the atom table has a hard limi...

EUVD-2026-31694

Hackney has unbounded buffer accumulation in WebSocket...

GHSA-Q8JG-FGJ4-FPHF Hackney has unbounded buffer accumulation in WebSocket

Summary The WebSocket client in src/hackneyws.erl imposes no upper bound on memory consumption across three distinct code paths. In each case, an attacker-controlled WebSocket server can exhaust the connecting process's memory without any authentication or special client configuration. Details 1...

Hackney has unbounded buffer accumulation in WebSocket

Summary The WebSocket client in src/hackneyws.erl imposes no upper bound on memory consumption across three distinct code paths. In each case, an attacker-controlled WebSocket server can exhaust the connecting process's memory without any authentication or special client configuration. Details 1...

EUVD-2026-31690

Hackney has CRLF / header injection in WebSocket upgrade request...

GHSA-F9VR-G2G2-X9FG Hackney has CRLF / header injection in WebSocket upgrade request

Summary CRLF injection in hackney's WebSocket upgrade request builder src/hackneyws.erl. init/1 copies the host, path, headers, and protocols options from the caller-supplied opts map verbatim into wsdata, and dohandshake/1 splices them directly into the raw HTTP/1.1 upgrade request by binary...