The vulnerability resides in hackney’s URL normalization routine, which decodes a percent‑encoded host component after the URL has been parsed. A crafted URL such as http://%31%32%37%2E%30%2E%30%2E%31/ passes an allowlist check that is based on the un‑decoded host string. Hackney then normalizes the host to 127.0.0.1 and opens a TCP connection, providing the attacker with the ability to reach internal services, cloud metadata endpoints, RFC1918 networks, or any other host listening on localhost. This flaw enables an attacker who can influence a Hackney request to exfiltrate data or trigger further actions on internal resources, thereby compromising confidentiality and integrity.

The affected product is the Hackney HTTP client library, distributed by Benoit C. Versions from 0.13.0 through 4.0.0 are vulnerable. The library is widely used in Erlang and BEAM‑based applications.

The CVSS score of 6.9 classifies the weakness as medium severity. No EPSS value is available, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires an application to pass a specifically crafted URL to hackney:request/5; the percent‑encoded host bypasses the allowlist and activates the vulnerability. Because the flaw is exercised on every URL passed to hackney, any vulnerable application that uses the library for outbound HTTP requests is potentially exposed. Given the medium CVSS score and lack of widespread exploitation data, the risk is moderate but should be addressed promptly.