hackney has 11 CVEs on record. Disclosures have slowed: 0 in the last 90 days after 11 in the 90 before. The busiest recent month was June 2026 with 11. None have a confirmed exploitation report. The dominant weakness classes are CWE-400 (4) and CWE-93 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- —
- Publish → KEV
- —
- Last 90 days
- 0 prev 11
Worst active — by depth score
CVE-2026-47077HighHackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM41CVE-2026-47074HighHackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM41CVE-2026-47073HighHackney has unbounded buffer accumulation in WebSocket41CVE-2026-47071HighHackney: `ssl:connect/2` post-handshake upgrade has no timeout41CVE-2026-47067HighHackney vulnerable to atom-table exhaustion via unrecognized URL schemes41
hackney vulnerabilities
CVEs affecting hackney, newest first. Open any entry for full detail, references, and exploit status.
11 CVEsRSS
CVE-2026-47077HighHackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM
Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM
CVE-2026-47066HighHackney has an infinite loop on non-token byte at start of an Alt-Svc entry
Hackney has an infinite loop on non-token byte at start of an Alt-Svc entry
CVE-2026-47071HighHackney: `ssl:connect/2` post-handshake upgrade has no timeout
Hackney: `ssl:connect/2` post-handshake upgrade has no timeout
CVE-2026-47076MediumHackney has SSRF allowlist bypass in hackney_url:normalize/2 via percent-encoded host
Hackney has SSRF allowlist bypass in hackney_url:normalize/2 via percent-encoded host
CVE-2026-47069LowHackney has CRLF / header injection via unvalidated `domain` and `path` options
Hackney has CRLF / header injection via unvalidated `domain` and `path` options
CVE-2026-47070MediumHackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body
Hackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body
CVE-2026-47074HighHackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM
Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM
CVE-2026-47075MediumHackney has CR/LF injection in query parameter
Hackney has CR/LF injection in query parameter
CVE-2026-47072MediumHackney has CRLF / header injection in WebSocket upgrade request
Hackney has CRLF / header injection in WebSocket upgrade request
CVE-2026-47073HighHackney has unbounded buffer accumulation in WebSocket
Hackney has unbounded buffer accumulation in WebSocket
CVE-2026-47067HighHackney vulnerable to atom-table exhaustion via unrecognized URL schemes
Hackney vulnerable to atom-table exhaustion via unrecognized URL schemes