CVE-2026-115700

Name of the Vulnerable Software and Affected Versions hackney versions 4.0.1 through 4.8.x

Description An interpretation conflict in hackney url allows Server Side Request Forgery (SSRF). This occurs when a host is provided as a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. While a caller's allowlist using uri string:parse/1 and inet:parse address/1 may not recognize these as IP addresses, hackney still connects to the denoted address. This also affects Location targets during redirects. The issue stems from hackney url:normalize/2 passing decoded values to inet parse:address/1 as is, while the connect path in hackney happy:parse address/1 drops surrounding brackets and the resolver ignores trailing dots, allowing these forms to bypass the IP-literal gate. Applications using an IP allowlist to prevent requests to internal addresses, such as loopback or link-local metadata, are susceptible.

Recommendations Update to version 4.9.0 or later. As a temporary workaround, run the allowlist on the host returned by hackney url:normalize/1 and strip any surrounding bracket pair and trailing dots from the host before performing the IP check.