Vulnerability-Lookup

GHSA-J9WQ-VXXC-94WF

Vulnerability from github – Published: 2026-06-26 21:58 – Updated: 2026-06-26 21:58

Summary

Hackney has CR/LF injection in query parameter

Details

Summary

hackney_url:make_url/3 passes the URL query component directly into the HTTP/1.1 request target without percent-encoding \r or \n. RFC 3986 §3.4 requires characters outside the query grammar to be percent-encoded, but no validation or escaping occurs. An attacker who controls any portion of the URL passed to hackney can inject raw CRLF sequences into the request line, enabling HTTP header injection or full request splitting.

Details

hackney_url:make_url/3 in src/hackney_url.erl builds the request target by concatenating the path and query binaries. The query string is used as-is — no character-class check, no percent-encoding of \r or \n. When hackney serializes the request, the query value lands verbatim in the GET <path>?<query> HTTP/1.1\r\n request line. A query value containing \r\n terminates the request line early; subsequent bytes are parsed by the server (or any intermediary proxy) as additional header lines or a second request.

A concrete example: a URL with query ?q=x HTTP/1.1\r\nX-Injected: yes\r\nX: produces the following on the wire:

GET /?q=x HTTP/1.1
X-Injected: yes
X: HTTP/1.1
Host: ...

The server sees X-Injected: yes as a legitimate request header that the client never intended to send.

PoC

Listen on a raw TCP port: nc -lvnp 8080.
Issue: :hackney.get("http://127.0.0.1:8080/?q=x HTTP/1.1\r\nX-Injected: yes\r\nX:").
Observe the listener receives X-Injected: yes as a standalone header line in the request.

Impact

HTTP header injection and request splitting against any server hackney connects to. Affects all released versions of hackney before 4.0.1. Exploitation requires an attacker-controlled URL (or URL component) to reach hackney without prior sanitization. Consequences include injecting arbitrary headers (Authorization, Host, X-Forwarded-For) and splitting requests through proxies. CVSS v4.0: 6.8 (MEDIUM).

Resources

Introduction commit: https://github.com/benoitc/hackney/commit/8bb1a359a81ae58567c84f8d24564e9742e6f2bd
Patch commit: https://github.com/benoitc/hackney/commit/ca73dd0aba0ed557449c18288bf07241671a43c9

Severity

6.8 (Medium)


                  
                    CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "hackney"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47075"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-93"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-26T21:58:59Z",
    "nvd_published_at": "2026-05-25T15:16:22Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n`hackney_url:make_url/3` passes the URL query component directly into the HTTP/1.1 request target without percent-encoding `\\r` or `\\n`. RFC 3986 \u00a73.4 requires characters outside the query grammar to be percent-encoded, but no validation or escaping occurs. An attacker who controls any portion of the URL passed to hackney can inject raw CRLF sequences into the request line, enabling HTTP header injection or full request splitting.\n\n### Details\n\n`hackney_url:make_url/3` in `src/hackney_url.erl` builds the request target by concatenating the path and query binaries. The query string is used as-is \u2014 no character-class check, no percent-encoding of `\\r` or `\\n`. When hackney serializes the request, the query value lands verbatim in the `GET \u003cpath\u003e?\u003cquery\u003e HTTP/1.1\\r\\n` request line. A query value containing `\\r\\n` terminates the request line early; subsequent bytes are parsed by the server (or any intermediary proxy) as additional header lines or a second request.\n\nA concrete example: a URL with query `?q=x HTTP/1.1\\r\\nX-Injected: yes\\r\\nX:` produces the following on the wire:\n\n```\nGET /?q=x HTTP/1.1\nX-Injected: yes\nX: HTTP/1.1\nHost: ...\n```\n\nThe server sees `X-Injected: yes` as a legitimate request header that the client never intended to send.\n\n### PoC\n\n1. Listen on a raw TCP port: `nc -lvnp 8080`.\n2. Issue: `:hackney.get(\"http://127.0.0.1:8080/?q=x HTTP/1.1\\r\\nX-Injected: yes\\r\\nX:\")`.\n3. Observe the listener receives `X-Injected: yes` as a standalone header line in the request.\n\n### Impact\n\nHTTP header injection and request splitting against any server hackney connects to. Affects all released versions of hackney before 4.0.1. Exploitation requires an attacker-controlled URL (or URL component) to reach hackney without prior sanitization. Consequences include injecting arbitrary headers (`Authorization`, `Host`, `X-Forwarded-For`) and splitting requests through proxies. CVSS v4.0: **6.8 (MEDIUM)**.\n\n## Resources\n\n* Introduction commit: https://github.com/benoitc/hackney/commit/8bb1a359a81ae58567c84f8d24564e9742e6f2bd\n* Patch commit: https://github.com/benoitc/hackney/commit/ca73dd0aba0ed557449c18288bf07241671a43c9",
  "id": "GHSA-j9wq-vxxc-94wf",
  "modified": "2026-06-26T21:58:59Z",
  "published": "2026-06-26T21:58:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47075"
    },
    {
      "type": "WEB",
      "url": "https://github.com/benoitc/hackney/commit/ca73dd0aba0ed557449c18288bf07241671a43c9"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-47075.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/benoitc/hackney"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-47075"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Hackney has CR/LF injection in query parameter"
}

CVE-2026-47075 (GCVE-0-2026-47075)

Vulnerability from cvelistv5 – Published: 2026-05-25 14:00 – Updated: 2026-05-27 15:41

Title

CR/LF injection in query parameter in hackney

Summary

Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r) or line feed (\n) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar defined in RFC 3986 Section 3.4 must be percent-encoded, but hackney_url:make_url/3 passes the query binary directly without validation or escaping. An attacker who can control all or part of a URL passed to hackney can inject raw CRLF sequences into the query string, which are then sent as HTTP line breaks in the request target. This enables injection of arbitrary HTTP headers or splitting of the HTTP request. This issue affects hackney: from 0 before 4.0.1.

Severity

6.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

Assigner

EEF

References

4 references

URL	Tags
https://github.com/benoitc/hackney/security/advis…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-47075.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-47075	related
https://github.com/benoitc/hackney/commit/ca73dd0…	patch

Impacted products

2 products

Vendor	Product	Version
benoitc	hackney	Affected: 0 , < 4.0.1 (semver) cpe:2.3:a:benoitc:hackney::::::::
benoitc	hackney	Affected: 8bb1a359a81ae58567c84f8d24564e9742e6f2bd , < ca73dd0aba0ed557449c18288bf07241671a43c9 (git) cpe:2.3:a:benoitc:hackney::::::::

Credits

tepel-chen Benoit Chesneau Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47075",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-26T15:50:04.477395Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-26T15:50:09.349Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "hackney_url"
          ],
          "packageName": "hackney",
          "packageURL": "pkg:hex/hackney",
          "product": "hackney",
          "programFiles": [
            "src/hackney_url.erl"
          ],
          "programRoutines": [
            {
              "name": "hackney_url:make_url/3"
            }
          ],
          "repo": "https://github.com/benoitc/hackney",
          "vendor": "benoitc",
          "versions": [
            {
              "lessThan": "4.0.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "hackney_url"
          ],
          "packageName": "benoitc/hackney",
          "packageURL": "pkg:github/benoitc/hackney",
          "product": "hackney",
          "programFiles": [
            "src/hackney_url.erl"
          ],
          "programRoutines": [
            {
              "name": "hackney_url:make_url/3"
            }
          ],
          "repo": "https://github.com/benoitc/hackney",
          "vendor": "benoitc",
          "versions": [
            {
              "lessThan": "ca73dd0aba0ed557449c18288bf07241671a43c9",
              "status": "affected",
              "version": "8bb1a359a81ae58567c84f8d24564e9742e6f2bd",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.0.1",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "AND"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "tepel-chen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Benoit Chesneau"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting.\u003cp\u003ehackney does not percent-encode carriage return (\u003ctt\u003e\\r\u003c/tt\u003e) or line feed (\u003ctt\u003e\\n\u003c/tt\u003e) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar defined in RFC 3986 Section 3.4 must be percent-encoded, but \u003ctt\u003ehackney_url:make_url/3\u003c/tt\u003e passes the query binary directly without validation or escaping. An attacker who can control all or part of a URL passed to hackney can inject raw CRLF sequences into the query string, which are then sent as HTTP line breaks in the request target. This enables injection of arbitrary HTTP headers or splitting of the HTTP request.\u003c/p\u003e\u003cp\u003eThis issue affects hackney: from 0 before 4.0.1.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\\r) or line feed (\\n) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar defined in RFC 3986 Section 3.4 must be percent-encoded, but hackney_url:make_url/3 passes the query binary directly without validation or escaping. An attacker who can control all or part of a URL passed to hackney can inject raw CRLF sequences into the query string, which are then sent as HTTP line breaks in the request target. This enables injection of arbitrary HTTP headers or splitting of the HTTP request.\n\nThis issue affects hackney: from 0 before 4.0.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-105",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-105 HTTP Request Splitting"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-93",
              "description": "CWE-93 Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T15:41:12.825Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-47075.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-47075"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/benoitc/hackney/commit/ca73dd0aba0ed557449c18288bf07241671a43c9"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "CR/LF injection in query parameter in hackney",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-47075",
    "datePublished": "2026-05-25T14:00:45.781Z",
    "dateReserved": "2026-05-18T17:28:08.322Z",
    "dateUpdated": "2026-05-27T15:41:12.825Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-J9WQ-VXXC-94WF

Summary

Details

PoC

Impact

Resources

CVE-2026-47075 (GCVE-0-2026-47075)

Tags

Sightings

Nomenclature