Benoitc Hackney 2.0.0/4.8.x HTTP CONNECT hackney_http_connect:handle_proxy_auth response splitting

Summaryinfo

A vulnerability categorized as critical has been discovered in Benoitc Hackney 2.0.0/4.8.x. Impacted is the function hackney_http_connect:handle_proxy_auth of the component HTTP CONNECT. The manipulation results in response splitting. This vulnerability is known as CVE-2026-112880. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Benoitc Hackney 2.0.0/4.8.x. Affected is the function hackney_http_connect:handle_proxy_auth of the component HTTP CONNECT. The manipulation with an unknown input leads to a response splitting vulnerability. CWE is classifying the issue as CWE-113. The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback returns. After a 407 response from an HTTP CONNECT proxy, hackney_http_connect:handle_proxy_auth/11 calls the caller's proxy_auth_fun with the status code and the response headers and writes the returned binary into the Proxy-Authorization line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy. The value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy's challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes. This issue affects hackney: from 2.0.0 before 4.9.0.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-112880 since 10/26/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

Upgrading to version 4.9.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Benoitc

Name

• Hackney

Version

• 2.0.0
• 4.8.x

Website

• Product: https://github.com/benoitc/hackney/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion