Vulnerability-Lookup

CVE-2026-47074 (GCVE-0-2026-47074)

Vulnerability from cvelistv5 – Published: 2026-05-28 09:05 – Updated: 2026-05-29 04:40

Title

ex_aws_sns SigningCertURL not validated in verify_message/1

Summary

Improper Certificate Validation vulnerability in ex-aws ex_aws_sns (ExAws.SNS, ExAws.SNS.PublicKeyCache modules) allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/ex_aws/sns.ex, lib/ex_aws/sns/public_key_cache.ex and program routines 'Elixir.ExAws.SNS':verify_message/1, 'Elixir.ExAws.SNS.PublicKeyCache':get/1. 'Elixir.ExAws.SNS':verify_message/1 fetches the signing certificate from the SigningCertURL field of the incoming SNS message without validating that the URL uses HTTPS or that the host matches an AWS-owned SNS certificate domain. An unauthenticated attacker who can POST to an endpoint that calls verify_message/1 can supply an attacker-controlled SigningCertURL, sign a forged SNS message with their own key, and cause the function to return :ok, completely bypassing SNS signature verification. This issue affects ex_aws_sns: from 2.0.1 before 2.3.5.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-28 10:29 UTC

CWE

CWE-295 - Improper Certificate Validation

Assigner

EEF mitre root

References

4 references

URL	Tags
https://github.com/ex-aws/ex_aws_sns/security/adv…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-47074.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-47074	related
https://github.com/ex-aws/ex_aws_sns/commit/1853d…	patch

Impacted products

2 products

Vendor	Product	Version	CPE status
ex-aws	ex_aws_sns	Affected: 2.0.1 , < 2.3.5 (semver) cpe:2.3:a:ex_aws_sns_project:ex_aws_sns::::::::
ex-aws	ex_aws_sns	Affected: a7ec21880943f4dac1d59bda557db0ffcd2b61fa , < 1853d280b152d10384a1e21a22cf22152a60be48 (git) cpe:2.3:a:ex_aws_sns_project:ex_aws_sns::::::::

Credits

Peter Ullrich Bernard Duggan Jonatan Männchen / EEF Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47074",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-28T10:29:45.193313Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-28T10:31:15.111Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://hex.pm",
          "cpes": [
            "cpe:2.3:a:ex_aws_sns_project:ex_aws_sns:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.ExAws.SNS\u0027",
            "\u0027Elixir.ExAws.SNS.PublicKeyCache\u0027"
          ],
          "packageName": "ex_aws_sns",
          "packageURL": "pkg:hex/ex_aws_sns",
          "product": "ex_aws_sns",
          "programFiles": [
            "lib/ex_aws/sns.ex",
            "lib/ex_aws/sns/public_key_cache.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.ExAws.SNS\u0027:verify_message/1"
            },
            {
              "name": "\u0027Elixir.ExAws.SNS.PublicKeyCache\u0027:get/1"
            }
          ],
          "repo": "https://github.com/ex-aws/ex_aws_sns",
          "vendor": "ex-aws",
          "versions": [
            {
              "lessThan": "2.3.5",
              "status": "affected",
              "version": "2.0.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ex_aws_sns_project:ex_aws_sns:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.ExAws.SNS\u0027",
            "\u0027Elixir.ExAws.SNS.PublicKeyCache\u0027"
          ],
          "packageName": "ex-aws/ex_aws_sns",
          "packageURL": "pkg:github/ex-aws/ex_aws_sns",
          "product": "ex_aws_sns",
          "programFiles": [
            "lib/ex_aws/sns.ex",
            "lib/ex_aws/sns/public_key_cache.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.ExAws.SNS\u0027:verify_message/1"
            },
            {
              "name": "\u0027Elixir.ExAws.SNS.PublicKeyCache\u0027:get/1"
            }
          ],
          "repo": "https://github.com/ex-aws/ex_aws_sns",
          "vendor": "ex-aws",
          "versions": [
            {
              "lessThan": "1853d280b152d10384a1e21a22cf22152a60be48",
              "status": "affected",
              "version": "a7ec21880943f4dac1d59bda557db0ffcd2b61fa",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe application must expose an HTTP endpoint that calls \u003ctt\u003e\u0027Elixir.ExAws.SNS\u0027:verify_message/1\u003c/tt\u003e on incoming request bodies.\u003c/p\u003e"
            }
          ],
          "value": "The application must expose an HTTP endpoint that calls \u0027Elixir.ExAws.SNS\u0027:verify_message/1 on incoming request bodies."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ex_aws_sns_project:ex_aws_sns:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.3.5",
                  "versionStartIncluding": "2.0.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "AND"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Bernard Duggan"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jonatan M\u00e4nnchen / EEF"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Certificate Validation vulnerability in ex-aws ex_aws_sns (\u003ctt\u003eExAws.SNS\u003c/tt\u003e, \u003ctt\u003eExAws.SNS.PublicKeyCache\u003c/tt\u003e modules) allows Signature Spoofing by Improper Validation.\u003cp\u003eThis vulnerability is associated with program files \u003ctt\u003elib/ex_aws/sns.ex\u003c/tt\u003e, \u003ctt\u003elib/ex_aws/sns/public_key_cache.ex\u003c/tt\u003e and program routines \u003ctt\u003e\u0027Elixir.ExAws.SNS\u0027:verify_message/1\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.ExAws.SNS.PublicKeyCache\u0027:get/1\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003e\u003ctt\u003e\u0027Elixir.ExAws.SNS\u0027:verify_message/1\u003c/tt\u003e fetches the signing certificate from the \u003ctt\u003eSigningCertURL\u003c/tt\u003e field of the incoming SNS message without validating that the URL uses HTTPS or that the host matches an AWS-owned SNS certificate domain. An unauthenticated attacker who can POST to an endpoint that calls \u003ctt\u003everify_message/1\u003c/tt\u003e can supply an attacker-controlled \u003ctt\u003eSigningCertURL\u003c/tt\u003e, sign a forged SNS message with their own key, and cause the function to return \u003ctt\u003e:ok\u003c/tt\u003e, completely bypassing SNS signature verification.\u003c/p\u003e\u003cp\u003eThis issue affects ex_aws_sns: from 2.0.1 before 2.3.5.\u003c/p\u003e"
            }
          ],
          "value": "Improper Certificate Validation vulnerability in ex-aws ex_aws_sns (ExAws.SNS, ExAws.SNS.PublicKeyCache modules) allows Signature Spoofing by Improper Validation.\n\nThis vulnerability is associated with program files lib/ex_aws/sns.ex, lib/ex_aws/sns/public_key_cache.ex and program routines \u0027Elixir.ExAws.SNS\u0027:verify_message/1, \u0027Elixir.ExAws.SNS.PublicKeyCache\u0027:get/1.\n\n\u0027Elixir.ExAws.SNS\u0027:verify_message/1 fetches the signing certificate from the SigningCertURL field of the incoming SNS message without validating that the URL uses HTTPS or that the host matches an AWS-owned SNS certificate domain. An unauthenticated attacker who can POST to an endpoint that calls verify_message/1 can supply an attacker-controlled SigningCertURL, sign a forged SNS message with their own key, and cause the function to return :ok, completely bypassing SNS signature verification.\n\nThis issue affects ex_aws_sns: from 2.0.1 before 2.3.5."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-473",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-473 Signature Spoofing by Improper Validation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-29T04:40:43.232Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ex-aws/ex_aws_sns/security/advisories/GHSA-8jgf-23q5-x7xx"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-47074.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-47074"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ex-aws/ex_aws_sns/commit/1853d280b152d10384a1e21a22cf22152a60be48"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ex_aws_sns SigningCertURL not validated in verify_message/1",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-47074",
    "datePublished": "2026-05-28T09:05:54.815Z",
    "dateReserved": "2026-05-18T17:28:08.322Z",
    "dateUpdated": "2026-05-29T04:40:43.232Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-47074",
      "date": "2026-09-25",
      "epss": "0.00377",
      "percentile": "0.28964"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://hex.pm",
                "cpes": [
                  "cpe:2.3:a:ex_aws_sns_project:ex_aws_sns:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.ExAws.SNS\u0027",
                  "\u0027Elixir.ExAws.SNS.PublicKeyCache\u0027"
                ],
                "packageName": "ex_aws_sns",
                "packageURL": "pkg:hex/ex_aws_sns",
                "product": "ex_aws_sns",
                "programFiles": [
                  "lib/ex_aws/sns.ex",
                  "lib/ex_aws/sns/public_key_cache.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.ExAws.SNS\u0027:verify_message/1"
                  },
                  {
                    "name": "\u0027Elixir.ExAws.SNS.PublicKeyCache\u0027:get/1"
                  }
                ],
                "repo": "https://github.com/ex-aws/ex_aws_sns",
                "vendor": "ex-aws",
                "versions": [
                  {
                    "lessThan": "2.3.5",
                    "status": "affected",
                    "version": "2.0.1",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://github.com",
                "cpes": [
                  "cpe:2.3:a:ex_aws_sns_project:ex_aws_sns:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.ExAws.SNS\u0027",
                  "\u0027Elixir.ExAws.SNS.PublicKeyCache\u0027"
                ],
                "packageName": "ex-aws/ex_aws_sns",
                "packageURL": "pkg:github/ex-aws/ex_aws_sns",
                "product": "ex_aws_sns",
                "programFiles": [
                  "lib/ex_aws/sns.ex",
                  "lib/ex_aws/sns/public_key_cache.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.ExAws.SNS\u0027:verify_message/1"
                  },
                  {
                    "name": "\u0027Elixir.ExAws.SNS.PublicKeyCache\u0027:get/1"
                  }
                ],
                "repo": "https://github.com/ex-aws/ex_aws_sns",
                "vendor": "ex-aws",
                "versions": [
                  {
                    "lessThan": "1853d280b152d10384a1e21a22cf22152a60be48",
                    "status": "affected",
                    "version": "a7ec21880943f4dac1d59bda557db0ffcd2b61fa",
                    "versionType": "git"
                  }
                ]
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Improper Certificate Validation vulnerability in ex-aws ex_aws_sns (ExAws.SNS, ExAws.SNS.PublicKeyCache modules) allows Signature Spoofing by Improper Validation.\n\nThis vulnerability is associated with program files lib/ex_aws/sns.ex, lib/ex_aws/sns/public_key_cache.ex and program routines \u0027Elixir.ExAws.SNS\u0027:verify_message/1, \u0027Elixir.ExAws.SNS.PublicKeyCache\u0027:get/1.\n\n\u0027Elixir.ExAws.SNS\u0027:verify_message/1 fetches the signing certificate from the SigningCertURL field of the incoming SNS message without validating that the URL uses HTTPS or that the host matches an AWS-owned SNS certificate domain. An unauthenticated attacker who can POST to an endpoint that calls verify_message/1 can supply an attacker-controlled SigningCertURL, sign a forged SNS message with their own key, and cause the function to return :ok, completely bypassing SNS signature verification.\n\nThis issue affects ex_aws_sns: from 2.0.1 before 2.3.5."
          }
        ],
        "id": "CVE-2026-47074",
        "lastModified": "2026-06-17T10:54:18.237",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-47074",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-28T10:29:45.193313Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-05-28T10:16:39.800",
        "references": [
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://cna.erlef.org/cves/CVE-2026-47074.html"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/ex-aws/ex_aws_sns/commit/1853d280b152d10384a1e21a22cf22152a60be48"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/ex-aws/ex_aws_sns/security/advisories/GHSA-8jgf-23q5-x7xx"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://osv.dev/vulnerability/EEF-CVE-2026-47074"
          }
        ],
        "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-295"
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-06-05T19:21:14+00:00",
      "cve": "CVE-2026-47074",
      "id": "CVE-2026-47074",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "ex_aws_sns SigningCertURL not validated in verify_message/1",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47074.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-47074",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-05-28T10:29:45.193313Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-05-28T10:31:09.474Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://hex.pm",
              "cpes": [
                "cpe:2.3:a:ex_aws_sns_project:ex_aws_sns:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.ExAws.SNS\u0027",
                "\u0027Elixir.ExAws.SNS.PublicKeyCache\u0027"
              ],
              "packageName": "ex_aws_sns",
              "packageURL": "pkg:hex/ex_aws_sns",
              "product": "ex_aws_sns",
              "programFiles": [
                "lib/ex_aws/sns.ex",
                "lib/ex_aws/sns/public_key_cache.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.ExAws.SNS\u0027:verify_message/1"
                },
                {
                  "name": "\u0027Elixir.ExAws.SNS.PublicKeyCache\u0027:get/1"
                }
              ],
              "repo": "https://github.com/ex-aws/ex_aws_sns",
              "vendor": "ex-aws",
              "versions": [
                {
                  "lessThan": "2.3.5",
                  "status": "affected",
                  "version": "2.0.1",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://github.com",
              "cpes": [
                "cpe:2.3:a:ex_aws_sns_project:ex_aws_sns:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.ExAws.SNS\u0027",
                "\u0027Elixir.ExAws.SNS.PublicKeyCache\u0027"
              ],
              "packageName": "ex-aws/ex_aws_sns",
              "packageURL": "pkg:github/ex-aws/ex_aws_sns",
              "product": "ex_aws_sns",
              "programFiles": [
                "lib/ex_aws/sns.ex",
                "lib/ex_aws/sns/public_key_cache.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.ExAws.SNS\u0027:verify_message/1"
                },
                {
                  "name": "\u0027Elixir.ExAws.SNS.PublicKeyCache\u0027:get/1"
                }
              ],
              "repo": "https://github.com/ex-aws/ex_aws_sns",
              "vendor": "ex-aws",
              "versions": [
                {
                  "lessThan": "1853d280b152d10384a1e21a22cf22152a60be48",
                  "status": "affected",
                  "version": "a7ec21880943f4dac1d59bda557db0ffcd2b61fa",
                  "versionType": "git"
                }
              ]
            }
          ],
          "configurations": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eThe application must expose an HTTP endpoint that calls \u003ctt\u003e\u0027Elixir.ExAws.SNS\u0027:verify_message/1\u003c/tt\u003e on incoming request bodies.\u003c/p\u003e"
                }
              ],
              "value": "The application must expose an HTTP endpoint that calls \u0027Elixir.ExAws.SNS\u0027:verify_message/1 on incoming request bodies."
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:ex_aws_sns_project:ex_aws_sns:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "2.3.5",
                      "versionStartIncluding": "2.0.1",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "AND"
                }
              ],
              "operator": "OR"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Peter Ullrich"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Bernard Duggan"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Jonatan M\u00e4nnchen / EEF"
            },
            {
              "lang": "en",
              "type": "analyst",
              "value": "Jonatan M\u00e4nnchen / EEF"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Improper Certificate Validation vulnerability in ex-aws ex_aws_sns (\u003ctt\u003eExAws.SNS\u003c/tt\u003e, \u003ctt\u003eExAws.SNS.PublicKeyCache\u003c/tt\u003e modules) allows Signature Spoofing by Improper Validation.\u003cp\u003eThis vulnerability is associated with program files \u003ctt\u003elib/ex_aws/sns.ex\u003c/tt\u003e, \u003ctt\u003elib/ex_aws/sns/public_key_cache.ex\u003c/tt\u003e and program routines \u003ctt\u003e\u0027Elixir.ExAws.SNS\u0027:verify_message/1\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.ExAws.SNS.PublicKeyCache\u0027:get/1\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003e\u003ctt\u003e\u0027Elixir.ExAws.SNS\u0027:verify_message/1\u003c/tt\u003e fetches the signing certificate from the \u003ctt\u003eSigningCertURL\u003c/tt\u003e field of the incoming SNS message without validating that the URL uses HTTPS or that the host matches an AWS-owned SNS certificate domain. An unauthenticated attacker who can POST to an endpoint that calls \u003ctt\u003everify_message/1\u003c/tt\u003e can supply an attacker-controlled \u003ctt\u003eSigningCertURL\u003c/tt\u003e, sign a forged SNS message with their own key, and cause the function to return \u003ctt\u003e:ok\u003c/tt\u003e, completely bypassing SNS signature verification.\u003c/p\u003e\u003cp\u003eThis issue affects ex_aws_sns: from 2.0.1 before 2.3.5.\u003c/p\u003e"
                }
              ],
              "value": "Improper Certificate Validation vulnerability in ex-aws ex_aws_sns (ExAws.SNS, ExAws.SNS.PublicKeyCache modules) allows Signature Spoofing by Improper Validation.\n\nThis vulnerability is associated with program files lib/ex_aws/sns.ex, lib/ex_aws/sns/public_key_cache.ex and program routines \u0027Elixir.ExAws.SNS\u0027:verify_message/1, \u0027Elixir.ExAws.SNS.PublicKeyCache\u0027:get/1.\n\n\u0027Elixir.ExAws.SNS\u0027:verify_message/1 fetches the signing certificate from the SigningCertURL field of the incoming SNS message without validating that the URL uses HTTPS or that the host matches an AWS-owned SNS certificate domain. An unauthenticated attacker who can POST to an endpoint that calls verify_message/1 can supply an attacker-controlled SigningCertURL, sign a forged SNS message with their own key, and cause the function to return :ok, completely bypassing SNS signature verification.\n\nThis issue affects ex_aws_sns: from 2.0.1 before 2.3.5."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-473",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-473 Signature Spoofing by Improper Validation"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "HIGH"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-295",
                  "description": "CWE-295 Improper Certificate Validation",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-29T04:40:43.232Z",
            "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "shortName": "EEF"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory",
                "related"
              ],
              "url": "https://github.com/ex-aws/ex_aws_sns/security/advisories/GHSA-8jgf-23q5-x7xx"
            },
            {
              "tags": [
                "related"
              ],
              "url": "https://cna.erlef.org/cves/CVE-2026-47074.html"
            },
            {
              "tags": [
                "related"
              ],
              "url": "https://osv.dev/vulnerability/EEF-CVE-2026-47074"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/ex-aws/ex_aws_sns/commit/1853d280b152d10384a1e21a22cf22152a60be48"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "ex_aws_sns SigningCertURL not validated in verify_message/1",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "assignerShortName": "EEF",
        "cveId": "CVE-2026-47074",
        "datePublished": "2026-05-28T09:05:54.815Z",
        "dateReserved": "2026-05-18T17:28:08.322Z",
        "dateUpdated": "2026-05-29T04:40:43.232Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-47074

Vulnerability from fkie_nvd - Published: 2026-05-28 10:16 - Updated: 2026-06-17 10:54

Severity

8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-47074.html
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ex-aws/ex_aws_sns/commit/1853d280b152d10384a1e21a22cf22152a60be48
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ex-aws/ex_aws_sns/security/advisories/GHSA-8jgf-23q5-x7xx
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-47074

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://hex.pm",
          "cpes": [
            "cpe:2.3:a:ex_aws_sns_project:ex_aws_sns:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.ExAws.SNS\u0027",
            "\u0027Elixir.ExAws.SNS.PublicKeyCache\u0027"
          ],
          "packageName": "ex_aws_sns",
          "packageURL": "pkg:hex/ex_aws_sns",
          "product": "ex_aws_sns",
          "programFiles": [
            "lib/ex_aws/sns.ex",
            "lib/ex_aws/sns/public_key_cache.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.ExAws.SNS\u0027:verify_message/1"
            },
            {
              "name": "\u0027Elixir.ExAws.SNS.PublicKeyCache\u0027:get/1"
            }
          ],
          "repo": "https://github.com/ex-aws/ex_aws_sns",
          "vendor": "ex-aws",
          "versions": [
            {
              "lessThan": "2.3.5",
              "status": "affected",
              "version": "2.0.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ex_aws_sns_project:ex_aws_sns:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.ExAws.SNS\u0027",
            "\u0027Elixir.ExAws.SNS.PublicKeyCache\u0027"
          ],
          "packageName": "ex-aws/ex_aws_sns",
          "packageURL": "pkg:github/ex-aws/ex_aws_sns",
          "product": "ex_aws_sns",
          "programFiles": [
            "lib/ex_aws/sns.ex",
            "lib/ex_aws/sns/public_key_cache.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.ExAws.SNS\u0027:verify_message/1"
            },
            {
              "name": "\u0027Elixir.ExAws.SNS.PublicKeyCache\u0027:get/1"
            }
          ],
          "repo": "https://github.com/ex-aws/ex_aws_sns",
          "vendor": "ex-aws",
          "versions": [
            {
              "lessThan": "1853d280b152d10384a1e21a22cf22152a60be48",
              "status": "affected",
              "version": "a7ec21880943f4dac1d59bda557db0ffcd2b61fa",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Certificate Validation vulnerability in ex-aws ex_aws_sns (ExAws.SNS, ExAws.SNS.PublicKeyCache modules) allows Signature Spoofing by Improper Validation.\n\nThis vulnerability is associated with program files lib/ex_aws/sns.ex, lib/ex_aws/sns/public_key_cache.ex and program routines \u0027Elixir.ExAws.SNS\u0027:verify_message/1, \u0027Elixir.ExAws.SNS.PublicKeyCache\u0027:get/1.\n\n\u0027Elixir.ExAws.SNS\u0027:verify_message/1 fetches the signing certificate from the SigningCertURL field of the incoming SNS message without validating that the URL uses HTTPS or that the host matches an AWS-owned SNS certificate domain. An unauthenticated attacker who can POST to an endpoint that calls verify_message/1 can supply an attacker-controlled SigningCertURL, sign a forged SNS message with their own key, and cause the function to return :ok, completely bypassing SNS signature verification.\n\nThis issue affects ex_aws_sns: from 2.0.1 before 2.3.5."
    }
  ],
  "id": "CVE-2026-47074",
  "lastModified": "2026-06-17T10:54:18.237",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47074",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-28T10:29:45.193313Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-28T10:16:39.800",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://cna.erlef.org/cves/CVE-2026-47074.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/ex-aws/ex_aws_sns/commit/1853d280b152d10384a1e21a22cf22152a60be48"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/ex-aws/ex_aws_sns/security/advisories/GHSA-8jgf-23q5-x7xx"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-47074"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

GHSA-8JGF-23Q5-X7XX

Vulnerability from github – Published: 2026-06-26 22:50 – Updated: 2026-06-30 17:16

Summary

ex_aws_sns: Trusted-attacker `SigningCertURL` permits complete SNS signature bypass

Details

Summary

ExAws.SNS.verify_message/1 fetches the signing certificate from the SigningCertURL field of the incoming SNS message without validating that the URL uses HTTPS or that its host is an AWS-owned SNS certificate domain. An unauthenticated attacker who can POST to any endpoint that calls verify_message/1 can supply an attacker-controlled SigningCertURL, sign a forged SNS message with their own RSA key, and cause the function to return :ok, completely bypassing SNS signature verification.

Details

In lib/ex_aws/sns.ex (lines 475–483), verify_message/1 performs three checks: validate_message_params/1 (confirms required fields are present), validate_signature_version/1 (confirms SignatureVersion == "1"), then signature verification. The signature step calls ExAws.SNS.PublicKeyCache.get(message["SigningCertURL"]) and passes the result to :public_key.verify/4.

Neither validate_message_params/1 nor any other step checks that SigningCertURL is an HTTPS URL or that the hostname matches the expected pattern (e.g. sns.<region>.amazonaws.com). PublicKeyCache.get/1 in lib/ex_aws/sns/public_key_cache.ex fetches whatever URL is provided and caches the certificate. The RSA signature then verifies against the attacker's own public key, and verify_message/1 returns :ok.

PoC

Generate an RSA keypair and host the DER/PEM public certificate at any URL reachable from the target server (e.g. http://attacker.example/cert.pem).
Build a forged Notification payload with an arbitrary TopicArn and Message, compute the canonical string-to-sign per the SNS spec, and sign it with the attacker private key.
Set SigningCertURL to the attacker URL and Signature to the base64-encoded signature.
POST the forged payload to any SNS webhook endpoint that calls ExAws.SNS.verify_message/1.
The function returns :ok; the application treats the message as authentic.

Configurations

The application must expose an HTTP endpoint that calls ExAws.SNS.verify_message/1 on incoming request bodies (the standard SNS webhook pattern).

Impact

Complete SNS signature authentication bypass. Affects ex_aws_sns from 2.0.1 through 2.3.4. Consequences include spoofing arbitrary Notification payloads, auto-confirming attacker-controlled SubscribeURL values to hijack topic delivery, and spoofing UnsubscribeConfirmation to disrupt legitimate subscriptions. No authentication or special configuration on the attacker side is required. CVSS v4.0: 8.7 (HIGH).

Resources

Introduction commit: https://github.com/ex-aws/ex_aws_sns/commit/a7ec21880943f4dac1d59bda557db0ffcd2b61fa
Patch commit: https://github.com/ex-aws/ex_aws_sns/commit/1853d280b152d10384a1e21a22cf22152a60be48

Severity

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "ex_aws_sns"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.1"
            },
            {
              "fixed": "2.3.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47074"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-26T22:50:27Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`ExAws.SNS.verify_message/1` fetches the signing certificate from the `SigningCertURL` field of the incoming SNS message without validating that the URL uses HTTPS or that its host is an AWS-owned SNS certificate domain. An unauthenticated attacker who can POST to any endpoint that calls `verify_message/1` can supply an attacker-controlled `SigningCertURL`, sign a forged SNS message with their own RSA key, and cause the function to return `:ok`, completely bypassing SNS signature verification.\n\n### Details\n\nIn `lib/ex_aws/sns.ex` (lines 475\u2013483), `verify_message/1` performs three checks: `validate_message_params/1` (confirms required fields are present), `validate_signature_version/1` (confirms `SignatureVersion == \"1\"`), then signature verification. The signature step calls `ExAws.SNS.PublicKeyCache.get(message[\"SigningCertURL\"])` and passes the result to `:public_key.verify/4`.\n\nNeither `validate_message_params/1` nor any other step checks that `SigningCertURL` is an HTTPS URL or that the hostname matches the expected pattern (e.g. `sns.\u003cregion\u003e.amazonaws.com`). `PublicKeyCache.get/1` in `lib/ex_aws/sns/public_key_cache.ex` fetches whatever URL is provided and caches the certificate. The RSA signature then verifies against the attacker\u0027s own public key, and `verify_message/1` returns `:ok`.\n\n### PoC\n\n1. Generate an RSA keypair and host the DER/PEM public certificate at any URL reachable from the target server (e.g. `http://attacker.example/cert.pem`).\n2. Build a forged `Notification` payload with an arbitrary `TopicArn` and `Message`, compute the canonical string-to-sign per the SNS spec, and sign it with the attacker private key.\n3. Set `SigningCertURL` to the attacker URL and `Signature` to the base64-encoded signature.\n4. POST the forged payload to any SNS webhook endpoint that calls `ExAws.SNS.verify_message/1`.\n5. The function returns `:ok`; the application treats the message as authentic.\n\n### Configurations\n\nThe application must expose an HTTP endpoint that calls `ExAws.SNS.verify_message/1` on incoming request bodies (the standard SNS webhook pattern).\n\n### Impact\n\nComplete SNS signature authentication bypass. Affects `ex_aws_sns` from 2.0.1 through 2.3.4. Consequences include spoofing arbitrary `Notification` payloads, auto-confirming attacker-controlled `SubscribeURL` values to hijack topic delivery, and spoofing `UnsubscribeConfirmation` to disrupt legitimate subscriptions. No authentication or special configuration on the attacker side is required. CVSS v4.0: **8.7 (HIGH)**.\n\n## Resources\n\n* Introduction commit: https://github.com/ex-aws/ex_aws_sns/commit/a7ec21880943f4dac1d59bda557db0ffcd2b61fa\n* Patch commit: https://github.com/ex-aws/ex_aws_sns/commit/1853d280b152d10384a1e21a22cf22152a60be48",
  "id": "GHSA-8jgf-23q5-x7xx",
  "modified": "2026-06-30T17:16:17Z",
  "published": "2026-06-26T22:50:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/benoitc/hackney/security/advisories/GHSA-jq4m-q6p2-8gwc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ex-aws/ex_aws_sns/security/advisories/GHSA-8jgf-23q5-x7xx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47074"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ex-aws/ex_aws_sns/commit/1853d280b152d10384a1e21a22cf22152a60be48"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ex-aws/ex_aws_sns"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-47074"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "ex_aws_sns: Trusted-attacker `SigningCertURL` permits complete SNS signature bypass"
}

GHSA-JQ4M-Q6P2-8GWC

Vulnerability from github – Published: 2026-06-26 21:57 – Updated: 2026-06-30 17:16

Summary

Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM

Details

Summary

hackney_h3:await_response_loop/6 in src/hackney_h3.erl accumulates the HTTP/3 response body in memory without any size cap. The after Timeout clause is a per-message inactivity timer, not a wall-clock deadline: every received stream_data chunk, housekeeping select message, or settings frame resets it. A malicious HTTP/3 server that drips one small chunk every Timeout - 1 ms with Fin = false and never terminates the stream keeps the loop alive indefinitely while the accumulation buffer grows without bound, eventually exhausting the BEAM process heap.

Details

In src/hackney_h3.erl, await_response_loop/6 (line 430) builds the body with:

NewBody = <<AccBody/binary, Data/binary>>

There is no max_body check and no monotonic deadline. The after Timeout clause at line 463 is restarted on each loop iteration. A server that ensures at least one message arrives within Timeout ms indefinitely (one small chunk per interval is sufficient) prevents the timeout from firing while AccBody grows linearly. The same module's wait_connected/3 (lines 388-389) shows the correct pattern: track an absolute start time and pass a shrinking Remaining budget into each receive. This loop does not.

Configurations

Only the HTTP/3 transport is affected. Applications using the default TCP/TLS hackney transport are not vulnerable. The vulnerability requires using hackney_h3 directly or passing {transport, h3} to hackney:request/5.

PoC

Stand up an HTTP/3 server that responds with 200 OK headers (Fin = false), then emits a small stream_data chunk every Timeout - margin ms with Fin = false indefinitely.
Issue hackney:request(get, Url, [], <<>>, [{transport, h3}]) against it.
Watch the client process heap grow monotonically. The configured timeout never fires; the process is eventually killed by max_heap_size or the OS OOM killer.

Impact

Remote denial of service via unbounded memory consumption. Affects hackney 2.0.0 through 4.0.0 when using the HTTP/3 transport against an attacker-controlled or attacker-influenced server. Each affected request consumes unbounded memory until the BEAM is killed. CVSS v4.0: 8.2 (HIGH).

Resources

Introduction commit: https://github.com/benoitc/hackney/commit/0334af206d5099fdf510ed9eda18e34396f065ad
Patch commit: https://github.com/benoitc/hackney/commit/3d25f9fea26c90609de9d64366fedfe5065413bc

Severity

8.2 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "hackney"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "4.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47077"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295",
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-26T21:57:33Z",
    "nvd_published_at": "2026-05-28T10:16:39Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`hackney_h3:await_response_loop/6` in `src/hackney_h3.erl` accumulates the HTTP/3 response body in memory without any size cap. The `after Timeout` clause is a per-message inactivity timer, not a wall-clock deadline: every received `stream_data` chunk, housekeeping `select` message, or `settings` frame resets it. A malicious HTTP/3 server that drips one small chunk every `Timeout - 1` ms with `Fin = false` and never terminates the stream keeps the loop alive indefinitely while the accumulation buffer grows without bound, eventually exhausting the BEAM process heap.\n\n### Details\n\nIn `src/hackney_h3.erl`, `await_response_loop/6` (line 430) builds the body with:\n\n```erlang\nNewBody = \u003c\u003cAccBody/binary, Data/binary\u003e\u003e\n```\n\nThere is no `max_body` check and no monotonic deadline. The `after Timeout` clause at line 463 is restarted on each loop iteration. A server that ensures at least one message arrives within `Timeout` ms indefinitely (one small chunk per interval is sufficient) prevents the timeout from firing while `AccBody` grows linearly. The same module\u0027s `wait_connected/3` (lines 388-389) shows the correct pattern: track an absolute start time and pass a shrinking `Remaining` budget into each `receive`. This loop does not.\n\n### Configurations\n\nOnly the HTTP/3 transport is affected. Applications using the default TCP/TLS hackney transport are not vulnerable. The vulnerability requires using `hackney_h3` directly or passing `{transport, h3}` to `hackney:request/5`.\n\n### PoC\n\n1. Stand up an HTTP/3 server that responds with `200 OK` headers (`Fin = false`), then emits a small `stream_data` chunk every `Timeout - margin` ms with `Fin = false` indefinitely.\n2. Issue `hackney:request(get, Url, [], \u003c\u003c\u003e\u003e, [{transport, h3}])` against it.\n3. Watch the client process heap grow monotonically. The configured timeout never fires; the process is eventually killed by `max_heap_size` or the OS OOM killer.\n\n### Impact\n\nRemote denial of service via unbounded memory consumption. Affects hackney 2.0.0 through 4.0.0 when using the HTTP/3 transport against an attacker-controlled or attacker-influenced server. Each affected request consumes unbounded memory until the BEAM is killed. CVSS v4.0: **8.2 (HIGH)**.\n\n## Resources\n\n* Introduction commit: https://github.com/benoitc/hackney/commit/0334af206d5099fdf510ed9eda18e34396f065ad\n* Patch commit: https://github.com/benoitc/hackney/commit/3d25f9fea26c90609de9d64366fedfe5065413bc",
  "id": "GHSA-jq4m-q6p2-8gwc",
  "modified": "2026-06-30T17:16:10Z",
  "published": "2026-06-26T21:57:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/benoitc/hackney/security/advisories/GHSA-jq4m-q6p2-8gwc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ex-aws/ex_aws_sns/security/advisories/GHSA-8jgf-23q5-x7xx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47077"
    },
    {
      "type": "WEB",
      "url": "https://github.com/benoitc/hackney/commit/3d25f9fea26c90609de9d64366fedfe5065413bc"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-47077.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/benoitc/hackney"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-47077"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-47074 (GCVE-0-2026-47074)

FKIE_CVE-2026-47074

GHSA-8JGF-23Q5-X7XX

Summary

Details

PoC

Configurations

Impact

Resources

GHSA-JQ4M-Q6P2-8GWC

Summary

Details

Configurations

PoC

Impact

Resources

Tags

Sightings

Nomenclature

Related by attack behaviour