CVE-2026-47075
published 2026-05-25CVE-2026-47075: Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r)…
PriorityP349high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.48%
38.6th percentile
Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r) or line feed (\n) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar defined in RFC 3986 Section 3.4 must be percent-encoded, but hackney_url:make_url/3 passes the query binary directly without validation or escaping. An attacker who can control all or part of a URL passed to hackney can inject raw CRLF sequences into the query string, which are then sent as HTTP line breaks in the request target. This enables injection of arbitrary HTTP headers or splitting of the HTTP request.
This issue affects hackney: from 0.13.1 before 4.0.1.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| benoitc | hackney | < 4.0.1 | 4.0.1 |
| benoitc | hackney | < 4.0.1 | 4.0.1 |
| benoitc | hackney | >= 0 < 4.0.1 | 4.0.1 |
| benoitc | hackney | >= 0.13.1 < 4.0.1 | 4.0.1 |
| benoitc | hackney | >= 8bb1a359a81ae58567c84f8d24564e9742e6f2bd < ca73dd0aba0ed557449c18288bf07241671a43c9 | ca73dd0aba0ed557449c18288bf07241671a43c9 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv4.06.8MEDIUMCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
cvelistv5v4.06.8MEDIUMCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Hackney has CR/LF injection in query parameter
ghsa·2026-06-26
CVE-2026-47075 [MEDIUM] CWE-93 Hackney has CR/LF injection in query parameter
Hackney has CR/LF injection in query parameter
### Summary
`hackney_url:make_url/3` passes the URL query component directly into the HTTP/1.1 request target without percent-encoding `\r` or `\n`. RFC 3986 §3.4 requires characters outside the query grammar to be percent-encoded, but no validation or escaping occurs. An attacker who controls any portion of the URL passed to hackney can inject raw CRLF sequences into the request line, enabling HTTP header injection or full request splitting.
### Details
`hackney_url:make_url/3` in `src/hackney_url.erl` builds the request target by concatenating the path and query binaries. The query string is used as-is — no character-class check, no percent-encoding of `\r` or `\n`. When hackney serializes the request, the query value lands verbatim in t
CVEList
CR/LF injection in query parameter in hackney
cvelistv5·2026-05-25·CVSS 6.8
CVE-2026-47075 [MEDIUM] CWE-93 CR/LF injection in query parameter in hackney
CR/LF injection in query parameter in hackney
Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r) or line feed (\n) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar defined in RFC 3986 Section 3.4 must be percent-encoded, but hackney_url:make_url/3 passes the query binary directly without validation or escaping. An attacker who can control all or part of a URL passed to hackney can inject raw CRLF sequences into the query string, which are then sent as HTTP line breaks in the request target. This enables injection of arbitrary HTTP headers or splitting of the HTTP request.
This issue affects hackney: from 0 before
VulDB
benoitc hackney up to 4.0.0 URL Query crlf injection (EUVD-2026-31687)
vuldb·2026-05-25
CVE-2026-47075 [LOW] benoitc hackney up to 4.0.0 URL Query crlf injection (EUVD-2026-31687)
A vulnerability was found in benoitc hackney up to 4.0.0 and classified as problematic. This affects an unknown function of the component URL Query. Such manipulation leads to crlf injection.
This vulnerability is documented as CVE-2026-47075. The attack needs to be performed locally. There is not any exploit available.
It is suggested to upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://cna.erlef.org/cves/CVE-2026-47075.htmlhttps://github.com/benoitc/hackney/commit/ca73dd0aba0ed557449c18288bf07241671a43c9https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wfhttps://osv.dev/vulnerability/EEF-CVE-2026-47075https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf
2026-05-25
Published