6.0
MEDIUM CVSS 4.0
CVE-2026-47070
HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney
Description

Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackney_h3.erl passes the original request headers unchanged to the redirect target without performing any cross-origin check. When a client issues an HTTP/3 request with follow_redirect enabled and includes Authorization or Cookie headers, a server responding with a 3xx redirect to a different host will cause the client to forward those credentials verbatim to the new origin. The main hackney.erl module has maybe_strip_auth_on_redirect/2 (guarded by the location_trusted option) to address CVE-2018-1000007, but hackney_h3.erl is missing this protection entirely. This issue affects hackney: from 3.1.1 before 4.0.1.

INFO

Published Date :

May 25, 2026, 2 p.m.

Last Modified :

May 25, 2026, 2 p.m.

Remotely Exploit :

Yes !

Source :

EEF
Affected Products

The following products are affected by CVE-2026-47070 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

No affected product recoded yet

CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 4.0 MEDIUM 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Solution
Update hackney to a version that addresses the HTTP/3 redirect handler vulnerability.
  • Update hackney to version 4.0.1 or later.
  • Ensure HTTP/3 redirect handler protects sensitive headers.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-47070 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-47070 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db

    May. 25, 2026

    Action Type Old Value New Value
    Added Description Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackney_h3.erl passes the original request headers unchanged to the redirect target without performing any cross-origin check. When a client issues an HTTP/3 request with follow_redirect enabled and includes Authorization or Cookie headers, a server responding with a 3xx redirect to a different host will cause the client to forward those credentials verbatim to the new origin. The main hackney.erl module has maybe_strip_auth_on_redirect/2 (guarded by the location_trusted option) to address CVE-2018-1000007, but hackney_h3.erl is missing this protection entirely. This issue affects hackney: from 3.1.1 before 4.0.1.
    Added CVSS V4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
    Added CWE CWE-601
    Added Reference https://cna.erlef.org/cves/CVE-2026-47070.html
    Added Reference https://github.com/benoitc/hackney/commit/c58d5b50bade146360b85caf3dc8065807b08246
    Added Reference https://github.com/benoitc/hackney/security/advisories/GHSA-h73q-4w9q-82h4
    Added Reference https://osv.dev/vulnerability/EEF-CVE-2026-47070
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.