CVE-2026-47070
Sensitive Data Exposure in hackney via HTTP/3 Redirect
Publication date: 2026-05-25
Last updated on: 2026-05-25
Assigner: EEF
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| benoitc | hackney | From 3.1.1 (inc) to 4.0.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-601 | The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Sensitive Data Exposure issue in the benoitc hackney HTTP client library, specifically in its HTTP/3 redirect handler (hackney_h3.erl). When a client makes an HTTP/3 request with the follow_redirect option enabled and includes sensitive headers like Authorization or Cookie, the client forwards these headers unchanged to the redirect target, even if the redirect points to a different host. This happens because the HTTP/3 redirect handler does not perform any cross-origin checks before forwarding the headers.
While the main hackney module has a mechanism (maybe_strip_auth_on_redirect/2) to prevent this by stripping authentication headers on redirects to untrusted locations, this protection is missing in the HTTP/3 redirect handler, leading to potential exposure of sensitive credentials to unintended hosts.
How can this vulnerability impact me? :
This vulnerability can lead to the unintended disclosure of sensitive credentials such as Authorization tokens or Cookies to third-party or malicious hosts when an HTTP/3 redirect occurs. If an attacker controls or monitors the redirect target, they could capture these credentials and use them to impersonate the user or gain unauthorized access to protected resources.
This exposure increases the risk of account compromise, data breaches, and unauthorized actions performed on behalf of the user, potentially leading to further security incidents.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows sensitive data such as Authorization or Cookie headers to be forwarded to unintended third-party origins without proper cross-origin checks. This exposure of sensitive credentials can lead to unauthorized access or data leakage.
Such exposure of sensitive data can negatively impact compliance with data protection regulations and standards like GDPR and HIPAA, which require strict controls over the handling and sharing of personal and sensitive information to prevent unauthorized disclosure.