CVE-2026-47069

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Response Splitting. The hackney_cookie:setcookie/3 function in src/hackney_cookie.erl validates the Name and Value arguments against CRLF and control characters, but concatenates the domain and path options verbatim into the output iolist with no equivalent check. An attacker who controls either option — for example by supplying a Host header value forwarded as the cookie domain, or a request path forwarded as the cookie path — can inject a literal CRLF sequence and arbitrary additional Set-Cookie headers into the HTTP response. This issue affects hackney: from 0.9.0 before 4.0.1.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cna.erlef.org/cves/CVE-2026-47069.html	Patch Third Party Advisory
https://github.com/benoitc/hackney/commit/8e02b99c28aea1b3fa2ddc0e66f51fe5bb0ac540	Patch
https://github.com/benoitc/hackney/security/advisories/GHSA-mp55-p8c9-rfw2	Exploit Patch Vendor Advisory
https://osv.dev/vulnerability/EEF-CVE-2026-47069	Patch Third Party Advisory
https://github.com/benoitc/hackney/security/advisories/GHSA-mp55-p8c9-rfw2	Exploit Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-25 15:16

Updated : 2026-07-24 10:10

NVD link : CVE-2026-47069

Mitre link : CVE-2026-47069

CVE.ORG link : CVE-2026-47069

JSON object : View

Products Affected

benoitc

hackney

CWE

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

{"id": "CVE-2026-47069", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47069", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T15:57:10.763778Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "affectedData": [{"cpes": ["cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"], "repo": "https://github.com/benoitc/hackney", "vendor": "benoitc", "modules": ["hackney_cookie"], "product": "hackney", "versions": [{"status": "affected", "version": "0.9.0", "lessThan": "4.0.1", "versionType": "semver"}], "packageURL": "pkg:hex/hackney", "packageName": "hackney", "programFiles": ["src/hackney_cookie.erl"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "hackney_cookie:setcookie/3"}]}, {"cpes": ["cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"], "repo": "https://github.com/benoitc/hackney", "vendor": "benoitc", "modules": ["hackney_cookie"], "product": "hackney", "versions": [{"status": "affected", "version": "602d5c7f2ea4acbc83ed75230655d935a0750ebc", "lessThan": "8e02b99c28aea1b3fa2ddc0e66f51fe5bb0ac540", "versionType": "git"}], "packageURL": "pkg:github/benoitc/hackney", "packageName": "benoitc/hackney", "programFiles": ["src/hackney_cookie.erl"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "hackney_cookie:setcookie/3"}]}]}], "published": "2026-05-25T15:16:21.870", "references": [{"url": "https://cna.erlef.org/cves/CVE-2026-47069.html", "tags": ["Patch", "Third Party Advisory"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/benoitc/hackney/commit/8e02b99c28aea1b3fa2ddc0e66f51fe5bb0ac540", "tags": ["Patch"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-mp55-p8c9-rfw2", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-47069", "tags": ["Patch", "Third Party Advisory"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-mp55-p8c9-rfw2", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "description": [{"lang": "en", "value": "CWE-93"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Response Splitting. The hackney_cookie:setcookie/3 function in src/hackney_cookie.erl validates the Name and Value arguments against CRLF and control characters, but concatenates the domain and path options verbatim into the output iolist with no equivalent check. An attacker who controls either option \u2014 for example by supplying a Host header value forwarded as the cookie domain, or a request path forwarded as the cookie path \u2014 can inject a literal CRLF sequence and arbitrary additional Set-Cookie headers into the HTTP response.\n\nThis issue affects hackney: from 0.9.0 before 4.0.1."}, {"lang": "es", "value": "La vulnerabilidad de Neutralizaci\u00f3n Incorrecta de Secuencias CRLF ('Inyecci\u00f3n CRLF') en benoitc hackney permite la Divisi\u00f3n de Respuesta HTTP. La funci\u00f3n hackney_cookie:setcookie/3 en src/hackney_cookie.erl valida los argumentos Name y Value contra CRLF y caracteres de control, pero concatena las opciones de dominio y ruta textualmente en la iolist de salida sin una verificaci\u00f3n equivalente. Un atacante que controla cualquiera de las opciones - por ejemplo, al proporcionar un valor de encabezado Host reenviado como el dominio de la cookie, o una ruta de solicitud reenviada como la ruta de la cookie - puede inyectar una secuencia CRLF literal y encabezados Set-Cookie adicionales arbitrarios en la respuesta HTTP.\n\nEste problema afecta a hackney: desde 0.9.0 antes de 4.0.1."}], "lastModified": "2026-07-24T10:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A2C4C69-56DC-4CAF-A8B8-C7B4322111A1", "versionEndExcluding": "4.0.1", "versionStartIncluding": "0.9.0"}], "operator": "OR"}]}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}