TI-2026-34671 Aliases CVE-2026-47069 GHSA-mp55-p8c9-rfw2

CRLF injection in cookie domain/path options in hackney

MEDIUM 44CWE-93Published 2026-05-25 · Updated 2026-05-27

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Response Splitting. The hackney_cookie:setcookie/3 function in src/hackney_cookie.erl validates the Name and Value arguments against CRLF and control characters, but concatenates the domain and path options verbatim into the output iolist with no equivalent check. An attacker who controls either option — for example by supplying a Host header value forwarded as the cookie domain, or a request path forwarded as the cookie path — can inject a literal CRLF sequence and arbitrary additional Set-Cookie headers into the HTTP response. This issue affects hackney: from 0.9.0 before 4.0.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00425 37th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed hackney (benoitc): 4.0.1hackney (Hex): 4.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
benoitc	hackney	0.9.0 to before 4.0.1	4.0.1	Patch available	CNA
—	hackney (Hex)	0.9.0 to before 4.0.1	4.0.1	Patch available	GHSA-mp55-p8c9-rfw2

hackney Vendorbenoitc Affected 0.9.0 to before 4.0.1 Fixed in 4.0.1 Patch available CNA
hackney (Hex) Vendor— Affected 0.9.0 to before 4.0.1 Fixed in 4.0.1 Patch available GHSA-mp55-p8c9-rfw2

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:benoitc:hackney::::::::	0.9.0 to before 4.0.1	Vulnerable	benoitc

cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:* Versions 0.9.0 to before 4.0.1 Vulnerable ·benoitc

Remediation

Fix · CNA hackney (benoitc) Fixed in 4.0.1
Fix · GHSA-mp55-p8c9-rfw2 hackney (Hex) Fixed in 4.0.1 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-05-25
benoitc hackney 4.0.1
10 records Highest priority Priority HIGH 6 HIGH, 4 MEDIUM
Other records, highest priority first
- TI-2026-34675 Unbounded memory consumption in WebSocket client in hackneyPriority HIGH 77
- TI-2026-34669 Atom table exhaustion via unrecognized URL schemes in hackneyPriority HIGH 77
- TI-2026-34668 Infinite loop in Alt-Svc header parser in hackneyPriority HIGH 77
Show all 10 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-47069
2026-10-03 Alias added: GHSA-mp55-p8c9-rfw2

References

Exploit 1

https://github.com/benoitc/hackney/security/advisories/GHSA-mp55-p8c9-rfw2

Patch 3

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-47069

Other 1

https://github.com/benoitc/hackney

TI-2026-34675 Unbounded memory consumption in WebSocket client in hackney CVSS 4.0HIGH 8.7
TI-2026-34669 Atom table exhaustion via unrecognized URL schemes in hackney CVSS 4.0HIGH 8.7
TI-2026-34668 Infinite loop in Alt-Svc header parser in hackney CVSS 4.0HIGH 8.7
TI-2026-34679 Unbounded body accumulation in HTTP/3 response loop in hackney CVSS 4.0HIGH 8.2
TI-2026-34673 SOCKS5 TLS upgrade ignores caller timeout in hackney CVSS 4.0HIGH 8.2
TI-2026-34674 CRLF injection in WebSocket upgrade request in hackney CVSS 4.0MEDIUM 6.9

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences