Benoitc - vulnerabilities (CVEs)
18 CVEs in 4 products, 5 in the last 30 days, newest from 2026-10-26.
Products
- Hackney - 15 CVEs
- Benoitcgunicorn - 2 CVEs
- Erlang Quic - 1 CVEs
- Gunicorn - 1 CVEs
Newest CVEs of Benoitc
- CVE-2026-97200 - CVSS 8.2 (high), 2026-10-26: Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory…
- CVE-2026-115693 - CVSS 9.1 (critical), 2026-10-26: Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private…
- CVE-2026-113440 - CVSS 6 (medium), 2026-10-26: Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials…
- CVE-2026-115700 - CVSS 6.9 (medium), 2026-10-26: Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an…
- CVE-2026-112880 - CVSS 2.1 (low), 2026-10-26: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in hackney_http_connect in benoitc hackney allows…
- CVE-2026-49457 - CVSS 9.1 (critical), 2026-08-14: erlang_quic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The…
- CVE-2026-47070 - CVSS 6.1 (medium), 2026-05-25: Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackney_h3.erl passes the…
- CVE-2026-47073 - CVSS 8.7 (high), 2026-05-25: Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The WebSocket client in src/hackney_ws.erl imposes no…
- CVE-2026-47077 - CVSS 8.2 (high), 2026-05-25: Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. hackney_h3:await_response_loop/6 accumulates the HTTP/3…
- CVE-2026-47072 - CVSS 7.5 (high), 2026-05-25: Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Request/Response Splitting. The WebSocket upgrade…
- CVE-2026-47076 - CVSS 6.9 (medium), 2026-05-25: Interpretation Conflict vulnerability in benoitc hackney allows Server Side Request Forgery. hackney_url:normalize/2 URL-decodes the host component after the…
- CVE-2026-47071 - CVSS 8.2 (high), 2026-05-25: Uncontrolled Resource Consumption vulnerability in benoitc hackney allows Flooding. The SOCKS5 transport in src/hackney_socks5.erl correctly applies the…
- CVE-2026-47075 - CVSS 7.5 (high), 2026-05-25: Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r)…
- CVE-2026-47069 - CVSS 5.3 (medium), 2026-05-25: Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Response Splitting. The hackney_cookie:setcookie/3…
- CVE-2026-47067 - CVSS 8.7 (high), 2026-05-25: Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackney_url.erl converts every…
- CVE-2026-47066 - CVSS 8.7 (high), 2026-05-25: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in benoitc hackney allows Excessive Allocation. The Alt-Svc response header parser in…
- CVE-2024-6827 - CVSS 7.5 (high), 2025-03-20: Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default…
- CVE-2024-1135 - CVSS 7.5 (high), 2024-04-16: Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting…
