eef-cve-2026-115693

{
  "affected": [
    {
      "database_specific": {
        "source": "https://cna.erlef.org/osv/EEF-CVE-2026-115693.json"
      },
      "package": {
        "ecosystem": "Hex",
        "name": "hackney",
        "purl": "pkg:hex/hackney"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.24.0"
            },
            {
              "fixed": "4.9.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": [
        "1.24.0",
        "1.24.1",
        "1.25.0",
        "2.0.0",
        "2.0.0-beta.1",
        "2.0.1",
        "3.0.0",
        "3.0.1",
        "3.0.2",
        "3.0.3",
        "3.1.0",
        "3.1.1",
        "3.1.2",
        "3.2.0",
        "3.2.1",
        "4.0.0",
        "4.0.1",
        "4.0.2",
        "4.0.3",
        "4.1.0",
        "4.2.0",
        "4.2.1",
        "4.2.2",
        "4.2.3",
        "4.3.0",
        "4.4.0",
        "4.4.1",
        "4.4.2",
        "4.4.3",
        "4.4.5",
        "4.5.0",
        "4.5.1",
        "4.5.2",
        "4.6.0",
        "4.6.1",
        "4.7.0",
        "4.7.1",
        "4.7.2",
        "4.7.3",
        "4.7.4",
        "4.8.0",
        "4.8.1",
        "4.8.2",
        "4.8.3",
        "4.8.4",
        "4.8.5",
        "4.8.6",
        "4.8.7"
      ]
    },
    {
      "database_specific": {
        "source": "https://cna.erlef.org/osv/EEF-CVE-2026-115693.json"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "d8a9afcf5c3849904274e2eba1df56c63d1a1a0c"
            },
            {
              "fixed": "915eb5737e9c489d8fc22eec8cdae30e9b027be4"
            }
          ],
          "repo": "https://github.com/benoitc/hackney",
          "type": "GIT"
        }
      ],
      "versions": [
        "4.8.6",
        "4.8.5",
        "4.8.4",
        "4.8.3",
        "4.8.2",
        "4.8.1",
        "4.8.0",
        "4.7.4",
        "4.7.3",
        "4.7.2",
        "4.7.1",
        "4.7.0",
        "4.6.1",
        "4.6.0",
        "4.5.2",
        "4.5.1",
        "4.5.0",
        "4.4.5",
        "4.4.4",
        "4.4.3",
        "4.4.2",
        "4.4.1",
        "4.4.0",
        "4.3.0",
        "4.2.3",
        "4.2.2",
        "4.2.1",
        "4.2.0",
        "4.1.0",
        "4.0.3",
        "4.0.2",
        "4.0.1",
        "4.0.0",
        "3.2.1",
        "3.2.0",
        "3.1.2",
        "3.1.1",
        "3.1.0",
        "3.0.3",
        "3.0.2",
        "3.0.1",
        "2.0.1",
        "2.0.0",
        "2.0.0-beta.1",
        "1.25.0",
        "1.24.1",
        "1.24.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-115693"
  ],
  "credits": [
    {
      "name": "Martin Karrer",
      "type": "FINDER"
    },
    {
      "name": "Martin Karrer",
      "type": "REMEDIATION_DEVELOPER"
    },
    {
      "name": "Jonatan Männchen / EEF",
      "type": "COORDINATOR"
    }
  ],
  "database_specific": {
    "capec_ids": [
      "CAPEC-94"
    ],
    "cpe_ids": [
      "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
    ],
    "cwe_ids": [
      "CWE-295"
    ]
  },
  "details": "## Summary\n\nImproper Certificate Validation vulnerability in `hackney_ssl` in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds `{partial_chain, fun hackney_ssl:partial_chain/1}` to every `verify_peer` configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured `cacerts`. `hackney_ssl:merge_ssl_opts/3` kept the callback when the caller replaced the trust store with `cacerts` or `cacertfile` in `ssl_options`, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root.\n\nThe hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname.\n\nThis issue affects hackney: from 1.24.0 before 4.9.0.\n\n## Details\n\n**1. Default trust options.** `hackney_ssl:check_hostname_opts/1` builds the `verify_peer` options for every TLS connection: the certifi `cacerts`, a hostname `verify_fun`, and `{partial_chain, fun hackney_ssl:partial_chain/1}`. The callback walks the peer chain and returns `{trusted_ca, Cert}` for the first certificate whose public key matches a root in the bundled certifi store, which lets OTP accept chains that end in a cross-signed root.\n\n**2. Merge keeps the callback.** When the caller passes `ssl_options`, `hackney_ssl:merge_ssl_opts/3` merges them over the defaults with the caller's values winning per key. `cacerts` or `cacertfile` replace the trust store, and a `cacertfile` removes the default `cacerts`, but `partial_chain` has no counterpart in the caller's options and stays.\n\n**3. Validation.** OTP consults `partial_chain` before the configured trust store. A peer chain that carries any publicly trusted root therefore gets that root as its trust anchor, and the pinned `cacerts` are never consulted. Only the hostname `verify_fun` still constrains the attacker.\n\n## Impact\n\nAn attacker positioned between the client and a server pinned to a private CA, holding a publicly trusted certificate for the pinned hostname, can impersonate the server and read or modify the traffic the client sends and receives.\n\n## Workarounds\n\nPass your own `{partial_chain, Fun}` in `ssl_options` alongside `cacerts` or `cacertfile`. A caller-supplied `partial_chain` replaces hackney's in the merge, and a callback that returns `unknown_ca` makes OTP validate against the configured `cacerts` only.\n\n## Configurations\n\nThe caller passes `cacerts` or `cacertfile` in `ssl_options` to restrict trust to a private CA, without a `partial_chain` of its own. Connections that use hackney's default certifi trust store are not affected.",
  "id": "EEF-CVE-2026-115693",
  "modified": "2026-10-26T14:00:04.842588289Z",
  "published": "2026-10-26T13:49:29.374Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/benoitc/hackney/pull/978"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-115693.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/benoitc/hackney/releases/tag/4.9.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/benoitc/hackney/commit/d8a9afcf5c3849904274e2eba1df56c63d1a1a0c"
    },
    {
      "type": "FIX",
      "url": "https://github.com/benoitc/hackney/commit/915eb5737e9c489d8fc22eec8cdae30e9b027be4"
    },
    {
      "type": "PACKAGE",
      "url": "https://hex.pm/packages/hackney"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney"
}