The vulnerability in the HTTP client library hackney permits an attacker to craft URLs that bypass a host allowlist and cause the client to make requests to internal addresses. By encoding a bracketed IPv6 literal or appending a trailing dot to an IP literal, the library’s normalisation and address parsing steps accept the value as a literal address. The allowlist check, which operates on the un-decoded host string, fails to recognise these encodings, letting requests reach loopback or any internal network target. This results in server‑side request forgery, enabling the attacker to access protected internal services, exfiltrate data, or perform further attacks.

The flaw is present in the Erlang HTTP client library hackney in all releases from version 4.0.1 up to, but not including, 4.9.0. Applications that depend on any of those versions and use the client to make outbound HTTP requests— for example, web services, APIs, or internal tooling— are potentially vulnerable. The library is distributed under the vendor name benoitc and is widely used in Erlang and Elixir projects. Users should verify the installed version and assess whether their code performs allowlist checks that could be bypassed by the described encodings.

The CVSS score of 6.9 indicates a moderate impact. No EPSS score is currently available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The bypass applies to both direct requests and redirects, meaning any component that accepts user‑supplied URLs can trigger SSRF. The exploit requires the application to use the vulnerable hackney library and to provide a specially crafted URL, but does not need privileged access beyond that. The potential damage is consistent with the Server‑Side Request Forgery pattern, where attackers can reach internal network hosts that are normally blocked by allowlists.