TI-2026-34677 Aliases CVE-2026-47075 GHSA-j9wq-vxxc-94wf

CR/LF injection in query parameter in hackney

MEDIUM 63CWE-93Published 2026-05-25 · Updated 2026-07-24

Key facts

Attack vector: Local
Privileges required: None
User interaction: Active
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r) or line feed (\n) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar defined in RFC 3986 Section 3.4 must be percent-encoded, but hackney_url:make_url/3 passes the query binary directly without validation or escaping. An attacker who can control all or part of a URL passed to hackney can inject raw CRLF sequences into the query string, which are then sent as HTTP line breaks in the request target. This enables injection of arbitrary HTTP headers or splitting of the HTTP request. This issue affects hackney: from 0.13.1 before 4.0.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00479 41st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed hackney (benoitc): 4.0.1hackney (Hex): 4.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
benoitc	hackney	0.13.1 to before 4.0.1	4.0.1	Patch available	CNA
—	hackney (Hex)	before 4.0.1	4.0.1	Patch available	GHSA-j9wq-vxxc-94wf

hackney Vendorbenoitc Affected 0.13.1 to before 4.0.1 Fixed in 4.0.1 Patch available CNA
hackney (Hex) Vendor— Affected before 4.0.1 Fixed in 4.0.1 Patch available GHSA-j9wq-vxxc-94wf

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:benoitc:hackney::::::::	before 4.0.1	Vulnerable	benoitc

cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:* Versions before 4.0.1 Vulnerable ·benoitc

Remediation

Fix · CNA hackney (benoitc) Fixed in 4.0.1
Fix · GHSA-j9wq-vxxc-94wf hackney (Hex) Fixed in 4.0.1 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-05-25
benoitc hackney 4.0.1
10 records Highest priority Priority HIGH 6 HIGH, 4 MEDIUM
Other records, highest priority first
- TI-2026-34675 Unbounded memory consumption in WebSocket client in hackneyPriority HIGH 77
- TI-2026-34669 Atom table exhaustion via unrecognized URL schemes in hackneyPriority HIGH 77
- TI-2026-34668 Infinite loop in Alt-Svc header parser in hackneyPriority HIGH 77
Show all 10 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-47075
2026-10-03 Alias added: GHSA-j9wq-vxxc-94wf

References

Exploit 1

https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf

Patch 3

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-47075

Other 1

https://github.com/benoitc/hackney

TI-2026-34675 Unbounded memory consumption in WebSocket client in hackney CVSS 4.0HIGH 8.7
TI-2026-34669 Atom table exhaustion via unrecognized URL schemes in hackney CVSS 4.0HIGH 8.7
TI-2026-34668 Infinite loop in Alt-Svc header parser in hackney CVSS 4.0HIGH 8.7
TI-2026-34679 Unbounded body accumulation in HTTP/3 response loop in hackney CVSS 4.0HIGH 8.2
TI-2026-34673 SOCKS5 TLS upgrade ignores caller timeout in hackney CVSS 4.0HIGH 8.2
TI-2026-34674 CRLF injection in WebSocket upgrade request in hackney CVSS 4.0MEDIUM 6.9

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences