Threats tagged 'ghsa-8c7g-m8h7-q24x'

A Server Side Request Forgery (SSRF) vulnerability exists in the hackney_url component of the benoitc hackney library. It arises from an interpretation conflict when handling percent-encoded bracketed IPv6 literals or IP literals with trailing dots. This causes the library to bypass allowlist checks and connect to unintended IP addresses. The issue affects hackney versions from 4.0.1 up to but not including 4.9.0.