CVE-2026-113440Published
HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-113440 · Microsoft / collected KEV context
cve-program · CVE-2026-113440
- https://github.com/benoitc/hackney/pull/979
- https://cna.erlef.org/cves/CVE-2026-113440.html
- https://osv.dev/vulnerability/EEF-CVE-2026-113440
- https://github.com/benoitc/hackney/releases/tag/4.9.0
- https://github.com/benoitc/hackney/commit/8f944559bdb83da60b5c06f6cf6d842591278364
- https://github.com/benoitc/hackney/commit/6548384b22ea196023a1963e2967d5715b6d9564
Related operational evidence
Explicit CVE identifiers- HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney · Newly collected advisory · 26 Oct 2026