CVE-2026-47076: SSRF allowlist bypass via percent-encoded host in hackney

Vulnerability summary

CVE-2026-47076 is a medium (CVSS 6.9) Interpretation Conflict vulnerability in benoitc hackney. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 13.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 25-05-2026
   PublishedVulnerability first disclosed.
2. 27-05-2026
   Last modifiedVulnerability information updated.

Description

Interpretation Conflict vulnerability in benoitc hackney allows Server Side Request Forgery. hackney_url:normalize/2 URL-decodes the host component after the URL has been parsed into a #hackney_url{} record. OTP's uri_string:parse/1 and inet:parse_address/1 do not decode percent-escapes in the host, so a URL such as http://%31%32%37%2E%30%2E%30%2E%31/ is seen by a caller's allowlist validator with host %31%32%37%2E%30%2E%30%2E%31 (not an IP address), which passes the allowlist check. hackney's normalizer then decodes the host to 127.0.0.1 and opens a TCP connection to loopback. Because hackney:request/5 always calls hackney_url:normalize/2 with no opt-out, every request that takes a binary or list URL is affected. The same technique reaches cloud instance metadata services (169.254.169.254), RFC1918 networks, and any admin interface listening on localhost. This issue affects hackney: from 0.13.0 before 4.0.1.

• CWE-436Interpretation ConflictProduct A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
• CWE-918Server-Side Request ForgeryThe web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.