GHSA-vq52-99r9-h5pw

Suggest an improvement
Source
https://github.com/advisories/GHSA-vq52-99r9-h5pw
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-vq52-99r9-h5pw/GHSA-vq52-99r9-h5pw.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-vq52-99r9-h5pw
Aliases
Published
2025-02-11T06:30:27Z
Modified
2025-12-04T23:59:40.705268Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L CVSS Calculator
  • 2.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L/E:P CVSS Calculator
Summary
Server-side Request Forgery (SSRF) in hackney
Details

Versions of the package hackney from 0.0.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI built-in module and hackey. Given the URL http://127.0.0.1?@127.2.2.2/, the URI function will parse and see the host as 127.0.0.1 (which is correct), and hackney will refer the host as 127.2.2.2/. This vulnerability can be exploited when users rely on the URL function for host checking.

Database specific 
{
    "severity": "LOW",
    "cwe_ids": [
        "CWE-918"
    ],
    "nvd_published_at": "2025-02-11T05:15:14Z",
    "github_reviewed_at": "2025-02-11T17:59:52Z",
    "github_reviewed": true
}
References

Affected packages

Hex / hackney

Package

Name
hackney
Purl
pkg:hex/hackney

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.21.0

Affected versions

0.*

0.13.1
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.2

1.*

1.0.1
1.0.2
1.0.5
1.0.6
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.10
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.5.7
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.1
1.8.0
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.9.0
1.10.0
1.10.1
1.11.0
1.12.0
1.12.1
1.13.0
1.14.0
1.14.2
1.14.3
1.15.0
1.15.1
1.15.2
1.16.0
1.17.0
1.17.1
1.17.2
1.17.3
1.17.4
1.18.0
1.18.1
1.18.2
1.19.0
1.19.1
1.20.0
1.20.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-vq52-99r9-h5pw/GHSA-vq52-99r9-h5pw.json"