Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-113440— HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney

Quick assessment

Affected
benoitc hackney
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Benoitc 开发的 Hackney 库中存在“凭证保护不足”的漏洞。该漏洞允许重定向服务器通过同主机但不同协议或端口的重定向，获取请求中的 和 Cookie 凭证。 当启用 选项时， 中的 函数会在调用 后，将请求重新发送至 目标地址。而该函数仅比较了当前 URL 与重定向 URL 的主机名。因此，若发生从 HTTPS 到 HTTP 的同主机重定向， 和 请求头将以明文形式重新发送，使得路径上的攻击者能够窃听并读取这些凭证；若重定向至同一主机的不同端口，则会将这些凭证传递给不同的服务。 选项按设计会将凭证转

CVSS 6.0 · Medium EPSS 0.31% · P24

Affected Version Matrix 2

VendorProduct Version RangeStatus
benoitc hackney 2.0.0< 4.9.0 affected
8f944559bdb83da60b5c06f6cf6d842591278364< 6548384b22ea196023a1963e2967d5715b6d9564 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-113440

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney
Source: CVE Program / CVE List V5
Vulnerability Description
Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged. This issue affects hackney: from 2.0.0 before 4.9.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
benoitc hackney 2.0.0 ~ 4.9.0 cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*
benoitc hackney 8f944559bdb83da60b5c06f6cf6d842591278364 ~ 6548384b22ea196023a1963e2967d5715b6d9564 cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-113440

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-113440

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-113440 (3)

Vendor Advisories for CVE-2026-113440 (2)

Vendor Pages for CVE-2026-113440 (1)

Same Patch Batch · benoitc · 2026-10-26 · 5 CVEs total

CVE-2026-115693 9.1 CRITICAL Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney
CVE-2026-97200 8.2 HIGH Unbounded response body buffering and decompression in hackney
CVE-2026-115700 6.9 MEDIUM SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hac
CVE-2026-112880 2.1 LOW CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney

IV. Related Vulnerabilities

Same product: hackney
Same vendor: benoitc
Same weakness: CWE-522