hackney CRLF injection via Proxy-Authorization from proxy_auth_fun
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
CRLF injection in hackney's hackney_http_connect lets an attacker add header lines to the CONNECT request sent to an HTTP proxy. After a 407 response, the library writes the value returned by the caller's proxy_auth_fun into the Proxy-Authorization line without checking for CR, LF or NUL bytes. The value is attacker-influenced when the callback derives it from untrusted data, such as the proxy's challenge headers. Affects hackney from 2.0.0 before 4.9.0, rated CVSS 4.0 2.1 (LOW) by the CNA, and CISA has not added it to KEV.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback returns. After a 407 response from an HTTP CONNECT proxy, hackney_http_connect:handle_proxy_auth/11 calls the caller's proxy_auth_fun with the status code and the response headers and writes the returned binary into the Proxy-Authorization line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy. The value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy's challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes. This issue affects hackney: from 2.0.0 before 4.9.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade hackney to 4.9.0 or later. Until then, validate that the value returned by proxy_auth_fun contains no CR, LF or NUL bytes before the library uses it.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA hackney (benoitc) Fixed in 4.9.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
benoitc hackney — hackney 4.9.0 release notes
5 records Highest priority Priority MEDIUM 2 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2026-80354 Unbounded response body buffering in hackney allows memory exhaustionPriority MEDIUM 42
- TI-2026-80383 Custom CA pinning bypass in hackney accepts public root certificatesPriority MEDIUM 41
- TI-2026-80384 SSRF allowlist bypass via encoded IPv6 literal in hackneyPriority LOW 29
Timeline
- 2026-10-26 Threatist record created from CVE-2026-112880
- 2026-10-26 CISA SSVC decision points changed
- 2026-10-27 Alias added: GHSA-5qp8-qrjx-2669
References
More benoitc vulnerabilities
- TI-2026-34675 Unbounded memory consumption in WebSocket client in hackney CVSS 4.0HIGH 8.7
- TI-2026-34669 Atom table exhaustion via unrecognized URL schemes in hackney CVSS 4.0HIGH 8.7
- TI-2026-34668 Infinite loop in Alt-Svc header parser in hackney CVSS 4.0HIGH 8.7
- TI-2026-34679 Unbounded body accumulation in HTTP/3 response loop in hackney CVSS 4.0HIGH 8.2
- TI-2026-34673 SOCKS5 TLS upgrade ignores caller timeout in hackney CVSS 4.0HIGH 8.2
- TI-2024-06330 HTTP Request Smuggling in benoitc/gunicorn CVSS 3.0HIGH 7.5
Sources
- CVE-2026-112880 · CVE Program
- CVE-2026-112880 · NVD
- FIRST EPSS
- GHSA-5qp8-qrjx-2669 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences