CVE-2025-1211 Server-side Request Forgery (SSRF) in hackney
Hackney library allows SSRF via URL parsing discrepancies, enabling attackers to bypass host checks and access internal resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-1211?
CVE-2025-1211 is a medium-severity server-side request forgery vulnerability in hackney, published on 11 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of the package hackney before 1.21.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI built-in module and hackey. Given the URL http://127.0.0.1?@127.2.2.2/, the URI function will parse and see the host as 127.0.0.1 (which is correct), and hackney will refer the host as 127.2.2.2/. This vulnerability can be exploited when users rely on the URL function for host checking.
Weakness: CWE-918
Which versions are affected by CVE-2025-1211?
2 open source packages ship an affected version, including hackney.
| Package | Affected | Fixed in |
|---|---|---|
hackney Hex | All versions | 1.21.0 |
hackney Hex | All versions | 1.21.0 |
How do I fix CVE-2025-1211?
Upgrade hackney to 1.21.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-1211 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-1211 exists.
Sources
Also known as GHSA-vq52-99r9-h5pw.