https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-47077.htmlhttps://patchthecve.com/cve/CVE-2026-47077.htmlFri, 24 Jul 2026 10:10:00 +0000HIGH 7.5: Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. hackney_h3:await_response_loop/6 accumulates the HTTP/3 response body in memory without any size cap. The after Timeout clause is a per-message inactivity timer that resets on every received chunk,https://patchthecve.com/cve/CVE-2026-47076.htmlhttps://patchthecve.com/cve/CVE-2026-47076.htmlFri, 24 Jul 2026 10:10:00 +0000MEDIUM 6.5: Interpretation Conflict vulnerability in benoitc hackney allows Server Side Request Forgery. hackney_url:normalize/2 URL-decodes the host component after the URL has been parsed into a #hackney_url{} record. OTP's uri_string:parse/1 and inet:parse_address/1 do not decode percent-escapes in the host,https://patchthecve.com/cve/CVE-2026-47075.htmlhttps://patchthecve.com/cve/CVE-2026-47075.htmlFri, 24 Jul 2026 15:17:23 +0000HIGH 7.5: Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r) or line feed (\n) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar definhttps://patchthecve.com/cve/CVE-2026-47073.htmlhttps://patchthecve.com/cve/CVE-2026-47073.htmlFri, 24 Jul 2026 10:10:00 +0000HIGH 7.5: Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The WebSocket client in src/hackney_ws.erl imposes no upper bound on memory consumption in three code paths. First, read_handshake_response/3 accumulates received bytes into a growing buffer with nhttps://patchthecve.com/cve/CVE-2026-47072.htmlhttps://patchthecve.com/cve/CVE-2026-47072.htmlFri, 24 Jul 2026 10:10:00 +0000HIGH 7.5: Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Request/Response Splitting. The WebSocket upgrade code in src/hackney_ws.erl copies the host, path, headers (ExtraHeaders), and protocols options from the caller-supplied opts map into the interhttps://patchthecve.com/cve/CVE-2026-47071.htmlhttps://patchthecve.com/cve/CVE-2026-47071.htmlFri, 24 Jul 2026 10:10:00 +0000HIGH 7.5: Uncontrolled Resource Consumption vulnerability in benoitc hackney allows Flooding. The SOCKS5 transport in src/hackney_socks5.erl correctly applies the caller-supplied timeout to the SOCKS5 negotiation phase, but then upgrades the connection to TLS using the two-argument form ssl:connect/2, which dhttps://patchthecve.com/cve/CVE-2026-47070.htmlhttps://patchthecve.com/cve/CVE-2026-47070.htmlFri, 24 Jul 2026 10:10:00 +0000MEDIUM 6.1: Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackney_h3.erl passes the original request headers unchanged to the redirect target without performing any cross-origin check. When a client issues an HTTP/3 request whttps://patchthecve.com/cve/CVE-2026-47069.htmlhttps://patchthecve.com/cve/CVE-2026-47069.htmlFri, 24 Jul 2026 10:10:00 +0000MEDIUM 5.3: Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Response Splitting. The hackney_cookie:setcookie/3 function in src/hackney_cookie.erl validates the Name and Value arguments against CRLF and control characters, but concatenates the domain and https://patchthecve.com/cve/CVE-2026-47067.htmlhttps://patchthecve.com/cve/CVE-2026-47067.htmlFri, 24 Jul 2026 10:10:00 +0000HIGH 7.5: Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackney_url.erl converts every unrecognized URL scheme to a permanent BEAM atom via binary_to_atom/2. BEAM atoms are never garbage-collected and the atom table defaults to a hhttps://patchthecve.com/cve/CVE-2026-47066.htmlhttps://patchthecve.com/cve/CVE-2026-47066.htmlFri, 24 Jul 2026 10:10:00 +0000HIGH 7.5: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in benoitc hackney allows Excessive Allocation. The Alt-Svc response header parser in src/hackney_altsvc.erl does not guarantee forward progress. When parse_token/2 receives a non-token, non-whitespace, non-comma byte (e.g. !, @, =