CVE-2026-47069 — CRLF Injection in Benoitc Hackney

Vendor	Product	Version range	Fixed in
benoitc	hackney	>= 0.9.0 < 4.0.1	4.0.1
benoitc	hackney	>= 0.9.0 < 4.0.1	4.0.1
benoitc	hackney	>= 0.9.0 < 4.0.1	4.0.1
benoitc	hackney	>= 602d5c7f2ea4acbc83ed75230655d935a0750ebc < 8e02b99c28aea1b3fa2ddc0e66f51fe5bb0ac540	8e02b99c28aea1b3fa2ddc0e66f51fe5bb0ac540

GHSA

Hackney has CRLF / header injection via unvalidated `domain` and `path` options

ghsa·2026-06-26

CVE-2026-47069 [LOW] CWE-93 Hackney has CRLF / header injection via unvalidated `domain` and `path` options Hackney has CRLF / header injection via unvalidated `domain` and `path` options ### Summary CRLF injection in `hackney_cookie:setcookie/3` (`src/hackney_cookie.erl`). The function validates `Name` and `Value` against CR/LF and control characters but concatenates the `domain` and `path` options verbatim into the output binary. If either option carries attacker-controlled data, a `Host` header forwarded as the cookie domain, a request URI forwarded as the cookie path, a `\r\n` in the value splits the `Set-Cookie` header and lets the attacker inject additional headers into the HTTP response. ### Details **1. Asymmetric validation** Lines 27–34 of `hackney_cookie.erl` run `binary:match` on `Name` and `Value`, rejecting `=`, `,`, `;`, whitespace, `\r`, `\n`, `\013`, and `\014`. The `Domain

CVEList

CRLF injection in cookie domain/path options in hackney

cvelistv5·2026-05-25·CVSS 2.1

CVE-2026-47069 [LOW] CWE-93 CRLF injection in cookie domain/path options in hackney CRLF injection in cookie domain/path options in hackney Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Response Splitting. The hackney_cookie:setcookie/3 function in src/hackney_cookie.erl validates the Name and Value arguments against CRLF and control characters, but concatenates the domain and path options verbatim into the output iolist with no equivalent check. An attacker who controls either option — for example by supplying a Host header value forwarded as the cookie domain, or a request path forwarded as the cookie path — can inject a literal CRLF sequence and arbitrary additional Set-Cookie headers into the HTTP response. This issue affects hackney: from 0.9.0 before 4.0.1.

VulDB

benoitc hackney up to 4.0.0 HTTP Response src/hackney_cookie.erl crlf injection (EUVD-2026-31683)

vuldb·2026-05-25

CVE-2026-47069 [LOW] benoitc hackney up to 4.0.0 HTTP Response src/hackney_cookie.erl crlf injection (EUVD-2026-31683) A vulnerability was found in benoitc hackney up to 4.0.0. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the file src/hackney_cookie.erl of the component HTTP Response Handler. The manipulation leads to crlf injection. This vulnerability is traded as CVE-2026-47069. An attack has to be approached locally. There is no exploit available. Upgrading the affected component is advised.

CVE-2026-47069: Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Response Splitting. The hackney_cookie:setcookie/3…

Affected

CVSS provenance