CVE-2026-115693

Improper Certificate Validation vulnerability in hackneyssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds partialchain, fun hackneyssl:partialchain/1 to eve...

CVE-2026-115693

The hackney_ssl component in benoitc hackney (versions 1.24.0 before 4.9.0 ) contains an Improper Certificate Validation vulnerability. The root cause is that hackney_ssl:merge_ssl_opts/3 retains a default partial_chain callback even when a user provides a custom cacerts or cacertfile to pin a pr...

EUVD-2026-109836

Improper Certificate Validation vulnerability in hackneyssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds partialchain, fun hackneyssl:partialchain/1 to eve...