{"schema":"threatline.record/2","record":{"id":"CVE-2026-113440","aliases":[],"summary":"HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney","details":"Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged.\n\nThis issue affects hackney: from 2.0.0 before 4.9.0.","categories":["Unclassified"],"product":"hackney","vendor":"benoitc","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113440","source_modified_at":"2026-10-26T13:49:17.377Z","fetched_at":"2026-10-26T19:10:57.178988Z","product":"hackney","vendor":"benoitc","versions":[{"lessThan":"4.9.0","status":"affected","version":"2.0.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113440","source_modified_at":"2026-10-26T13:49:17.377Z","fetched_at":"2026-10-26T19:10:57.178988Z","product":"hackney","vendor":"benoitc","versions":[{"lessThan":"6548384b22ea196023a1963e2967d5715b6d9564","status":"affected","version":"8f944559bdb83da60b5c06f6cf6d842591278364","versionType":"git"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113440","source_modified_at":"2026-10-26T13:49:17.377Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"name":"hackney","ecosystem":null},"version":"4.9.0","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113440","source_modified_at":"2026-10-26T13:49:17.377Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"name":"hackney","ecosystem":null},"version":"6548384b22ea196023a1963e2967d5715b6d9564","basis":"first unaffected version stated in the CVE record"}],"cvss":6,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-26T13:49:17.377Z","modified_at":"2026-10-26T13:49:17.377Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-113440","fetched_at":"2026-10-26T19:10:57.178988Z","source_modified_at":"2026-10-26T13:49:17.377Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/benoitc/hackney/pull/979","tags":["related"]},{"source":"CVE List","url":"https://cna.erlef.org/cves/CVE-2026-113440.html","tags":["related"]},{"source":"CVE List","url":"https://osv.dev/vulnerability/EEF-CVE-2026-113440","tags":["related"]},{"source":"CVE List","url":"https://github.com/benoitc/hackney/releases/tag/4.9.0","tags":["vendor-advisory","related"]},{"source":"CVE List","url":"https://github.com/benoitc/hackney/commit/8f944559bdb83da60b5c06f6cf6d842591278364","tags":["related"]},{"source":"CVE List","url":"https://github.com/benoitc/hackney/commit/6548384b22ea196023a1963e2967d5715b6d9564","tags":["patch"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-26T13:49:17.377Z","content_hash":"a089b00726d80b752dcd54ca7f5f9763a651b62b8cdb6f919cedc4e2e5de33a6"}}