benoitc hackney up to 4.0.0 URL src/hackney_ws.erl crlf injection

Summaryinfo

A vulnerability labeled as problematic has been found in benoitc hackney up to 4.0.0. This vulnerability affects unknown code of the file src/hackney_ws.erl of the component URL Handler. Such manipulation leads to crlf injection. This vulnerability is uniquely identified as CVE-2026-47072. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in benoitc hackney up to 4.0.0 and classified as problematic. Affected by this issue is an unknown part of the file src/hackney_ws.erl of the component URL Handler. The manipulation with an unknown input leads to a crlf injection vulnerability. Using CWE to declare the problem leads to CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. Impacted is integrity. CVE summarizes:

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Request/Response Splitting. The WebSocket upgrade code in src/hackney_ws.erl copies the host, path, headers (ExtraHeaders), and protocols options from the caller-supplied opts map into the internal #ws_data{} record in init/1 and then splices them verbatim into the raw HTTP/1.1 upgrade request by binary concatenation in do_handshake/1. No CRLF or NUL stripping is performed at any of these four injection sites. An attacker who controls any of these options — for example by forwarding URL components or header values from untrusted input into hackney_ws:start_link/1 — can inject arbitrary HTTP headers into the outbound WebSocket upgrade request, leading to header injection, credential spoofing toward the upstream server, log and cache poisoning, or request smuggling via intermediary proxies. This issue affects hackney: from 2.0.0 before 4.0.1.

The weakness was disclosed by Peter Ullrich and Jonatan Männchen. The advisory is available at github.com. This vulnerability is handled as CVE-2026-47072 since 05/18/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 4.0.1 eliminates this vulnerability. Applying the patch 52310ca807e7b48441ba0e9129171f535313fdd1 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-31690). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• benoitc

Name

• hackney

Version

• 4.0

Website

• Product: https://github.com/benoitc/hackney/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion