CVE-2026-115693

Name of the Vulnerable Software and Affected Versions benoitc hackney versions 1.24.0 through 4.8.9

Description Improper certificate validation in hackney ssl allows an on-path attacker to impersonate a server pinned to a private certificate authority. This occurs because hackney ssl:merge ssl opts/3 retains a default callback {partial chain, fun hackney ssl:partial chain/1} even when a user replaces the trust store with cacerts or cacertfile in ssl options. Since OTP prioritizes this callback over the configured trust store, any certificate chain ending in a publicly trusted root is accepted, bypassing the private CA pinning. The attacker must possess a publicly trusted certificate for the pinned hostname to succeed.

Recommendations Update to version 4.9.0 or later. As a temporary workaround, provide a custom {partial chain, Fun} in ssl options that returns unknown ca to force validation against the configured cacerts only.