CVE-2026-47070

Name of the Vulnerable Software and Affected Versions benoitc hackney versions 3.1.1 through 4.0.0

Description A sensitive data exposure issue exists where the HTTP/3 redirect handler in src/hackney h3.erl passes original request headers to a redirect target without performing cross-origin checks. If a client makes an HTTP/3 request with follow redirect enabled and includes Authorization or Cookie headers, a server responding with a 3xx redirect to a different host will cause the client to forward these credentials verbatim to the new origin. This occurs because hackney h3.erl lacks the protection provided by the maybe strip auth on redirect() function found in the main hackney.erl module.

Recommendations Update to version 4.0.1.