CVE-2026-47076

CVE-2026-47076 affects the hackney HTTP client (from 0.13.0 up to, but not including, 4.0.1). The issue1 arises because hackney_url:normalize/2 decodes the host after parsing, while OTP’s uri_string:parse/1 and inet:parse_address/1 do not decode percent-escapes, allowing a crafted URL such as htt...

CVE-2026-47070

The vulnerability CVE-2026-47070 affects the Hackney HTTP client. It specifically concerns the HTTP/3 redirect handler (src/hackney_h3.erl) which forwards the original request headers to the redirect target without any cross-origin checking when follow_redirect is enabled. This causes Authorizati...