CVE-2026-47075 CR/LF injection in query parameter in hackney
Attackers can inject CRLF sequences into URLs to split HTTP requests or inject headers, affecting applications using the hackney library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-47075?
CVE-2026-47075 is a medium-severity vulnerability in benoitc hackney, published on 25 May 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r) or line feed (\n) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar defined in RFC 3986 Section 3.4 must be percent-encoded, but hackney_url:make_url/3 passes the query binary directly without validation or escaping. An attacker who can control all or part of a URL passed to hackney can inject raw CRLF sequences into the query string, which are then sent as HTTP line breaks in the request target. This enables injection of arbitrary HTTP headers or splitting of the HTTP request.
This issue affects hackney: from 0.13.1 before 4.0.1.
Weakness: CWE-93
Which versions are affected by CVE-2026-47075?
3 open source packages ship an affected version, including hackney. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
hackney Hex | All versions | 4.0.1 |
hackney Hex | All versions | 4.0.1 |
hackney Hex | From 0.13.1 | 4.0.1 |
Products include Benoitc Hackney.
How do I fix CVE-2026-47075?
Upgrade hackney to 4.0.1 or later.
Is CVE-2026-47075 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47075 exists.
Other vulnerabilities in benoitc hackney
- CVE-2026-47066 Infinite loop in Alt-Svc header parser in hackney
- CVE-2026-47067 Atom table exhaustion via unrecognized URL schemes in hackney
- CVE-2026-47073 Unbounded memory consumption in WebSocket client in hackney
- CVE-2026-47071 SOCKS5 TLS upgrade ignores caller timeout in hackney
- CVE-2026-47077 Unbounded body accumulation in HTTP/3 response loop in hackney
Sources
Also known as EEF-CVE-2026-47075, GHSA-j9wq-vxxc-94wf.