CVE-2026-115693 benoitc CVE debrief

Who should care

Defenders responsible for configuring and maintaining the hackney library, particularly those using private certificate authorities, should assess their exposure and apply patches or compensating controls as needed.

Why it matters

CVE-2026-115693 is a critical vulnerability in hackney_ssl that allows on-path attackers to impersonate servers pinned to private certificate authorities. Defenders should verify hackney library versions, apply patches, and review configurations to prevent potential impersonation attacks.

• An on-path attacker could impersonate a server pinned to a private certificate authority, potentially leading to unauthorized access or data breaches.
• The vulnerability requires verification of the hackney library version and application of patches to prevent exploitation.
• Defenders must review and update configurations to ensure proper certificate validation and monitor for suspicious activity.

Technical summary

The hackney_ssl component of the hackney library is vulnerable to improper certificate validation. This allows an on-path attacker to impersonate a server pinned to a private certificate authority by presenting a certificate chain that ends in a publicly trusted root. The vulnerability affects hackney versions from 1.24.0 before 4.9.0. To address this issue, defenders should verify the hackney library version, apply patches, and review configurations to prevent potential impersonation attacks. Additionally, defenders should monitor for suspicious activity and implement compensating controls as needed to prevent exploitation.

Defensive priority

Defenders should prioritize verifying the hackney library version and applying patches to prevent potential impersonation attacks.

Recommended defensive actions

• Verify the hackney library version and apply patches to prevent potential impersonation attacks.
• Review and update configurations to ensure proper certificate validation.
• Monitor for suspicious activity and implement compensating controls as needed.
• Perform vulnerability scanning to identify potentially exposed systems.
• Implement additional monitoring and logging to detect potential attacks.
• Conduct a thorough review of the hackney library configuration and usage.
• Develop and deploy a remediation plan for affected systems.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. Additional information is available from various source references, including GitHub commits and releases.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.