CVE-2026-47070

creationtimestamp| type| source ---|---|--- 2026-06-26 22:35:10+00:00| published-proof-of-concept| https://github.com/benoitc/hackney/security/advisories/GHSA-h73q-4w9q-82h4...

CVE-2026-47070 HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney

Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackneyh3.erl passes the original request headers unchanged to the redirect target without performing any cross-origin check. When a client issues an HTTP/3 request...