Answer in brief
CVE-2026-115700 records a Medium severity (CVSS 6.9) vulnerability in SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney. The current sources do not mark it as known exploited. The current feed maps benoitc/benoitc/hackney (generic), benoitc/hackney (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps benoitc/benoitc/hackney (generic), benoitc/hackney (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| benoitc/benoitc/hackneygeneric | >=452620a92ec1da2e6b4862a049a2a4f04b42068f <f19561a0b422376348c91537e51377ab7325f4ee | f19561a0b422376348c91537e51377ab7325f4ee |
| benoitc/hackneygeneric | >=4.0.1 <4.9.0 | 4.9.0 |
Published upstream
Oct 26, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 26, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 26, 2026
Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D (decoding to [::ffff:127.0.0.1]) or 127.0.0.1. is not an IP address to a caller's allowlist built on uri_string:parse/1 and inet:parse_address/1, while hackney connects to the address it denotes. The same applies to a Location target when redirects are followed. The IP-literal gate that hackney_url:normalize/2 applies to a percent-decoded host, added to close the percent-encoded IP bypass of CVE-2026-47076, passes the decoded value to inet_parse:address/1 as is. The connect path in hackney_happy:parse_address/1 drops a surrounding bracket pair, and the resolver ignores a trailing dot, so both forms pass the gate and still reach the literal address. Domain names with a trailing dot and unencoded IPv6 literals are not affected. This issue affects hackney: from 4.0.1 before 4.9.0.
Quoted source text, attributed separately from HOL analysis.