6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47076

CVE-2026-47076: SSRF allowlist bypass via percent-encoded host in hackney

Interpretation Conflict vulnerability in benoitc hackney allows Server Side Request Forgery. hackney_url:normalize/2 URL-decodes the host component after the URL has been parsed into a #hackney_url{} record. OTP's uri_string:parse/1 and inet:parse_address/1 do not decode percent-escapes in the host, so a URL such as http://%31%32%37%2E%30%2E%30%2E%31/ is seen by a caller's allowlist validator with host %31%32%37%2E%30%2E%30%2E%31 (not an IP address), which passes the allowlist check. hackney's normalizer then decodes the host to 127.0.0.1 and opens a TCP connection to loopback. Because hackney:request/5 always calls hackney_url:normalize/2 with no opt-out, every request that takes a binary or list URL is affected. The same technique reaches cloud instance metadata services (169.254.169.254), RFC1918 networks, and any admin interface listening on localhost.

This issue affects hackney: from 0.13.0 before 4.0.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47076

CVE-2026-47076:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hackney	erlang	>= 0.13.0, < 4.0.1	4.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) caused by a parser differential in the hackney library. The root cause is in the hackney_url:normalize/2 function, which decodes percent-encoded characters in the host part of a URL. An attacker could provide a URL with a percent-encoded IP address (e.g., http://%31%32%37%2E%30%2E%30%2E%31/). An application's SSRF filter, using Erlang's inet:parse_address/1 on the raw URL, would not recognize this as an IP address and would allow the request. However, when this URL is passed to hackney, the hackney_url:normalize/2 function is called, which decodes the host to 127.0.0.1. The library then proceeds to make a request to this loopback address, resulting in an SSRF. The patch mitigates this by adding a check in hackney_url:normalize/2 to verify if a host becomes an IP address after decoding and, if so, it rejects the URL. The hackney:request/5 function is also identified as a key function, as it's the primary function that developers use to make requests and it always invokes the vulnerable normalization logic.

Vulnerable functions

hackney_url:normalize

src/hackney_url.erl

This function is responsible for normalizing the URL, which includes URL-decoding the host. The vulnerability lies in the fact that it would decode a percent-encoded IP address, which could have bypassed an SSRF allowlist check performed by the caller on the un-normalized URL. The function did not check if a host that was not an IP address before decoding became one after decoding.

hackney:request

src/hackney.erl

This function is the main entry point for making HTTP requests in the hackney library. It takes a URL as input and, as part of its execution, it always calls the vulnerable `hackney_url:normalize/2` function. Therefore, any application using `hackney:request/5` to send requests to user-supplied URLs would be vulnerable to the SSRF attack.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.