How many CVEs have a located fix in benoitc/hackney?

12 published CVEs have a fix traced to functions in benoitc/hackney, touching 21 functions across 10 files.

Which function in benoitc/hackney has been patched by the most CVEs?

parse_url in src/hackney_url.erl has been changed by 2 CVE fixes, from 2025 to 2026.

How large is a typical CVE fix in benoitc/hackney?

The median fix changes 30 lines. 33% of fixes change 20 lines or fewer, and 42% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

erlang

#496 of 500 repositories

benoitc/hackney

Name: benoitc/hackney: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix May 25, 2026

12

CVE fixes located

Published CVEs

21

Functions patched

Distinct function sites

10

Files patched

Distinct source files

2025–2026

Years covered

By CVE publication date

Overview

12 published CVEs have a fix traced to functions in benoitc/hackney, the earliest published in 2025. Those fixes changed 21 distinct functions across 10 files, in 132 patch hunks.

Among the 500 repositories tracked here, benoitc/hackney ranks #496 by the number of CVEs with a located fix.

Most patched functions

Functions in benoitc/hackney changed by the most CVE fixes.

Most patched files

Files in benoitc/hackney changed by the most CVE fixes.

1src/hackney_url.erl3 CVEs · 4 functions
2src/hackney_h3.erl2 CVEs · 5 functions
3src/hackney_ws.erl2 CVEs · 3 functions
4src/hackney_conn.erl1 CVEs · 3 functions
5test/hackney_conn_tests.erl1 CVEs · 2 functions
6src/hackney_altsvc.erl1 CVEs · 1 functions
7src/hackney_cookie.erl1 CVEs · 1 functions
8src/hackney.erl1 CVEs · 1 functions
9src/hackney_http_connect.erl1 CVEs · 1 functions
10src/hackney_socks5.erl1 CVEs · 0 functions

Fix size

How much code a CVE fix in benoitc/hackney changes, with backports counted once.

30

Median lines changed

Added plus removed, per CVE

33%

Fixes of 20 lines or fewer

Share of CVE fixes

42%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in benoitc/hackney, and the functions each fix changed.

Unbounded memory consumption in WebSocket client in hackney
CVE-2026-47073message_within_limit read_handshake_response init
High · CVSS 8.7
EPSS 0.8%2026-05-25
Atom table exhaustion via unrecognized URL schemes in hackney
CVE-2026-47067parse_url
High · CVSS 8.7
EPSS 0.7%2026-05-25
CRLF injection in WebSocket upgrade request in hackney
CVE-2026-47072
Medium · CVSS 6.9
EPSS 0.5%2026-05-25
SSRF allowlist bypass via percent-encoded host in hackney
CVE-2026-47076
Medium · CVSS 6.9
EPSS 0.2%2026-05-25
HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney
CVE-2026-47070maybe_strip_redirect_headers
Medium · CVSS 6.0
EPSS 0.3%2026-05-25
CR/LF injection in query parameter in hackney
CVE-2026-47075valid_request_target request_async request_streaming
Medium · CVSS 6.8
EPSS 0.4%2026-05-25
Unbounded body accumulation in HTTP/3 response loop in hackney
CVE-2026-47077await_response_loop remaining await_response
High · CVSS 8.2
EPSS 0.7%2026-05-25
SOCKS5 TLS upgrade ignores caller timeout in hackney
CVE-2026-47071connect_to_proxy
High · CVSS 8.2
EPSS 0.7%2026-05-25
Infinite loop in Alt-Svc header parser in hackney
CVE-2026-47066seek_next_entry
High · CVSS 8.7
EPSS 0.7%2026-05-25
CRLF injection in cookie domain/path options in hackney
CVE-2026-47069setcookie
Low · CVSS 2.1
EPSS 0.4%2026-05-25
Connection pool exhaustion in hackney
CVE-2025-3864reply_response
Low · CVSS 2.3
EPSS 0.8%2025-05-28
Server-side Request Forgery (SSRF) in hackney
CVE-2025-1211parse_url parse_fragment parse_path
Medium · CVSS 6.3
EPSS 0.5%2025-02-11

Get an alert for each new benoitc/hackney CVE, with the patched functions and AI-written analysis.

Monitor hackney CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

1Panel-dev/CordysCRM12 CVEs android.googlesource.com/platform-hardware-qcom-media12 CVEs apache/inlong12 CVEs chocobozzz/peertube12 CVEs apache/kylin13 CVEs apache/superset13 CVEs bagisto/bagisto13 CVEs better-auth/better-auth13 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in benoitc/hackney.

How many CVEs have a located fix in benoitc/hackney?: 12 published CVEs have a fix traced to functions in benoitc/hackney, touching 21 functions across 10 files.
Which function in benoitc/hackney has been patched by the most CVEs?: parse_url in src/hackney_url.erl has been changed by 2 CVE fixes, from 2025 to 2026.
How large is a typical CVE fix in benoitc/hackney?: The median fix changes 30 lines. 33% of fixes change 20 lines or fewer, and 42% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track benoitc/hackney CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing