ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-113440

HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney

Published Oct 26, 2026 · catalog updated Oct 26, 2026 · HTTP/1.1 and HTTP/2 redirects

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-113440. EPSS is 0.31%. Act only if a listed version of HTTP/1.1 and HTTP/2 redirects is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (HTTP/1.1 and HTTP/2 redirects).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Unknown—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.31%
Remediation
Advisory link
Affected products
Hex hackney

## Summary Insufficiently Protected Credentials vulnerability in in benoitc hackney allows a redirecting server to obtain the and credentials of a request via a same-host redirect to another scheme or port. With enabled, in reissues the request to the target after , which compared only the hostname of the current and the redirect URL. A redirect from to on the same host resent the and headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. forwards credentials to any target by design and is unchanged. This issue affects hackney: from 2.0.0 before 4.9.0. ## Details **1. Redirect handling.** With set, hands a 3xx response to in , which resolves the header against the current URL and calls again with the caller's options and an empty header list. HTTP/1.1 and HTTP/2 share this path. **2. Host-only comparison.** Before the new request, removes the and options when the redirect leaves the current host, unless is set. It compared of the two URLs. **3. Consequence.** A redirect that keeps the hostname but changes the scheme or the port passes the check, so the new request carries the same and headers. From to they travel in cleartext; to another port they reach a different service on the same host. ## Impact A server that answers a credentialed request with a same-host redirect to plain HTTP exposes the client's and headers to anyone on the network path, and a redirect to another port delivers them to whatever service listens there. The captured values can be replayed against the original origin. ## Workarounds Disable and handle the header in the application, or pass the credentials as explicit and request headers instead of the and options. issues the redirected request with an empty header list, so explicit headers reach the first server only. ## Configurations The request is made with enabled and the or option set, over HTTP/1.1 or HTTP/2, without . Credentials passed as explicit

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Hex hackney2.0.0 → 4.9.0

How to fix CVE-2026-113440

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-113440. EPSS is 0.31%. Act only if a listed version of HTTP/1.1 and HTTP/2 redirects is installed.

Which versions are affected?

Compare what you have installed with 2.0.0 → 4.9.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-522: Insufficiently Protected Credentials. EPSS 0.31%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 26, 2026 · OpenSSF OSV / OSV Scanner

    Detected

    ## Summary Insufficiently Protected Credentials vulnerability in in benoitc hackney allows a redirecting server to obtain the and credentials of a request via a same-host redirect to another scheme or port. With enabled, in reissues the request to the target after , which compared only the hostname of the current and the redirect URL. A redirect from to on the same host resent the and headers in c

  2. Oct 26, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    hackney fixed in 4.9.0

  3. Oct 26, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    hackney fixed in 4.9.0

  4. Oct 26, 2026 · OpenSSF OSV / OSV Scanner

    Updated

    ## Summary Insufficiently Protected Credentials vulnerability in in benoitc hackney allows a redirecting server to obtain the and credentials of a request via a same-host redirect to another scheme or port. With enabled, in reissues the request to the target after , which compared only the hostname of the current and the redirect URL. A redirect from to on the same host resent the and headers in c

Sources

  • CVE.orgVulnerability recordCVE-2026-113440

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-113440

    30-day exploitation probability 0.31%

    first.org
  • OpenSSF OSV / OSV ScannerPackage advisoryEEF-CVE-2026-113440

    HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney

    osv.dev

References

Freshness

Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 5, 2026
  • CVE.orgOct 27, 2026
  • OpenSSF OSV / OSV ScannerOct 26, 2026