CVE-2025-1211

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Versions of the package hackney before 1.21.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI built-in module and hackey. Given the URL http://127.0.0.1?@127.2.2.2/, the URI function will parse and see the host as 127.0.0.1 (which is correct), and hackney will refer the host as 127.2.2.2/. This vulnerability can be exploited when users rely on the URL function for host checking.

Published 2025-02-11. Last modified 2026-06-17.