-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from URL parsing order inconsistencies between URI module and Hackney. The commit diff shows critical changes to parse_url/2 logic:- 1) Renamed parse_fragment -> cut_fragment- 2) Added cut_query processing before path splitting- 3) Modified raw_path construction. The original implementation parsed fragments first (allowing '@' in queries to affect host resolution), while the patched version processes queries before userinfo. The test case added for 'http://127.0.0.1?@127.2.2.2/' confirms this was the exploitation vector.
ErlangErlang| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| hackney | erlang | < 1.21.0 | 1.21.0 |
Ongoing coverage of React2Shell