CVE-2026-113440 HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-113440?
CVE-2026-113440 is a medium-severity vulnerability in benoitc hackney, published on 26 Oct 2026.
Official description
Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged.
This issue affects hackney: from 2.0.0 before 4.9.0.
Weakness: CWE-522
Which versions are affected by CVE-2026-113440?
1 open source package ship an affected version, including hackney.
| Package | Affected | Fixed in |
|---|---|---|
hackney Hex | From 2.0.0 | 4.9.0 |
How do I fix CVE-2026-113440?
Upgrade hackney to 4.9.0 or later.
Is CVE-2026-113440 being exploited?
There is no known exploitation of CVE-2026-113440 in the wild and no public exploit code.
Sources
Also known as EEF-CVE-2026-113440, GHSA-m347-hm9w-wwv9.