Answer in brief
CVE-2026-115693 records a Critical severity (CVSS 9.1) vulnerability in Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney. The current sources do not mark it as known exploited. The current feed maps benoitc/benoitc/hackney (generic), benoitc/hackney (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps benoitc/benoitc/hackney (generic), benoitc/hackney (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| benoitc/benoitc/hackneygeneric | >=d8a9afcf5c3849904274e2eba1df56c63d1a1a0c <915eb5737e9c489d8fc22eec8cdae30e9b027be4 | 915eb5737e9c489d8fc22eec8cdae30e9b027be4 |
| benoitc/hackneygeneric | >=1.24.0 <4.9.0 | 4.9.0 |
Published upstream
Oct 26, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 26, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 26, 2026
Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root. The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname. This issue affects hackney: from 1.24.0 before 4.9.0.
Quoted source text, attributed separately from HOL analysis.