benoitc hackney up to 4.0.0 HTTP Response src/hackney_cookie.erl crlf injection

Summaryinfo

A vulnerability categorized as problematic has been discovered in benoitc hackney up to 4.0.0. Affected by this issue is some unknown functionality of the file src/hackney_cookie.erl of the component HTTP Response Handler. The manipulation results in crlf injection. This vulnerability is known as CVE-2026-47069. Attacking locally is a requirement. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in benoitc hackney up to 4.0.0. Affected is an unknown functionality of the file src/hackney_cookie.erl of the component HTTP Response Handler. The manipulation with an unknown input leads to a crlf injection vulnerability. CWE is classifying the issue as CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. This is going to have an impact on integrity. CVE summarizes:

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Response Splitting. The hackney_cookie:setcookie/3 function in src/hackney_cookie.erl validates the Name and Value arguments against CRLF and control characters, but concatenates the domain and path options verbatim into the output iolist with no equivalent check. An attacker who controls either option — for example by supplying a Host header value forwarded as the cookie domain, or a request path forwarded as the cookie path — can inject a literal CRLF sequence and arbitrary additional Set-Cookie headers into the HTTP response. This issue affects hackney: from 0.9.0 before 4.0.1.

The weakness was published by Peter Ullrich and Jonatan Männchen. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-47069 since 05/18/2026. The exploitability is told to be easy. The attack needs to be approached locally. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

Upgrading to version 4.0.1 eliminates this vulnerability. Applying the patch 8e02b99c28aea1b3fa2ddc0e66f51fe5bb0ac540 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-31683). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• benoitc

Name

• hackney

Version

• 4.0

Website

• Product: https://github.com/benoitc/hackney/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion