benoitc hackney up to 4.8.9 hackney_ssl hackney_ssl:merge_ssl_opts certificate validation

Summaryinfo

A vulnerability classified as problematic has been found in benoitc hackney up to 4.8.9. This affects the function hackney_ssl:merge_ssl_opts of the component hackney_ssl. This manipulation causes certificate validation. The identification of this vulnerability is CVE-2026-115693. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as problematic was found in benoitc hackney up to 4.8.9. Affected by this vulnerability is the function hackney_ssl:merge_ssl_opts of the component hackney_ssl. The manipulation with an unknown input leads to a certificate validation vulnerability. The CWE definition for the vulnerability is CWE-295. The product does not validate, or incorrectly validates, a certificate. As an impact it is known to affect integrity. The summary by CVE is:

Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root. The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname. This issue affects hackney: from 1.24.0 before 4.9.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-115693 since 10/25/2026. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/26/2026). The attack technique deployed by this issue is T1587.003 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• benoitc

Name

• hackney

Version

• 4.8.0
• 4.8.1
• 4.8.2
• 4.8.3
• 4.8.4
• 4.8.5
• 4.8.6
• 4.8.7
• 4.8.8
• 4.8.9

Website

• Product: https://github.com/benoitc/hackney/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion