Vulnerabilities

Vulnerability · CVE-2026-115700

SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney

Published Oct 26, 2026 · catalog updated Oct 26, 2026 · SSRF allowlist bypass via

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-115700. EPSS is 0.14%. Act only if a listed version of SSRF allowlist bypass via is installed.

Severity

Unknown—

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.14%

Remediation

Advisory link

Affected products

Hex hackney

## Summary Interpretation Conflict vulnerability in in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as (decoding to ) or is not an IP address to a caller's allowlist built on and , while hackney connects to the address it denotes. The same applies to a target when redirects are followed. The IP-literal gate that applies to a percent-decoded host, added to close the percent-encoded IP bypass of CVE-2026-47076, passes the decoded value to as is. The connect path in drops a surrounding bracket pair, and the resolver ignores a trailing dot, so both forms pass the gate and still reach the literal address. Domain names with a trailing dot and unencoded IPv6 literals are not affected. This issue affects hackney: from 4.0.1 before 4.9.0. ## Details **1. The gate.** in percent-decodes a host that is not already an IP literal and raises when accepts the decoded value. This closed the plain percent-encoded IP case. **2. What the connect path accepts.** removes a surrounding pair before calling , and the resolver treats a trailing dot as the root label. Neither form is accepted by , so and pass the gate. **3. Result.** A percent-encoded bracketed IPv6 literal such as , or an IPv4 literal with a trailing dot, is not an IP address to a caller's check based on and , but hackney connects to the address it denotes. The same applies to a target when redirects are followed. The fix strips one bracket pair and one trailing dot in before the gate. ## Impact An application that checks user-supplied URLs against an IP allowlist before handing them to hackney can be made to request loopback, link-local metadata and private-network addresses that the allowlist rejects when they are written plainly. ## Workarounds Run the allowlist on the host that returns for the parsed URL, and strip a surrounding bracket pair and a trailing dot from it before the IP check, so the check sees the same addres