Skip to content
Heist/ feed
Back to feed
Medium

CR/LF injection in query parameter in hackney

Type: advisorySources: OSV

Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r) or line feed (\n) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar defined in RFC 3986 Section 3.4 must be percent-encoded, but hackney_url:make_url/3 passes the query binary directly without validation or escaping. An attacker who can control all or part of a URL passed to hackney can inject raw CRLF sequences into the query string, which are then sent as HTTP line breaks in the request target. This enables injection of arbitrary HTTP headers or splitting of the HTTP request. This issue affects hackney: from 0.13.1 before 4.0.1.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-47075
Confirmed fixed CVEs
Not specified
Updated in this feed
2 Nov 2026, 17:17 UTC · Revision 1

Source evidence

CR/LF injection in query parameter in hackney

core-osv · Original source

Published 25 May 2026, 14:00 UTC

Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r) or line feed (\n) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar defined in RFC 3986 Section 3.4 must be percent-encoded, but hackney_url:make_url/3 passes the query binary directly without validation or escaping. An attacker who can control all or part of a URL passed to hackney can inject raw CRLF sequences into the query string, which are then sent as HTTP line breaks in the request target. This enables injection of arbitrary HTTP headers or splitting of the HTTP request. This issue affects hackney: from 0.13.1 before 4.0.1.

osv:CVE-2026-47075
Complete source record
{
  "id": "13acdb1e134c424e03d991ded63754aef7f903b5cdc282d8015d344b2075430d",
  "url": "https://osv.dev/vulnerability/CVE-2026-47075",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CR/LF injection in query parameter in hackney",
    "summary": "Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\\r) or line feed (\\n) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar defined in RFC 3986 Section 3.4 must be percent-encoded, but hackney_url:make_url/3 passes the query binary directly without validation or escaping. An attacker who can control all or part of a URL passed to hackney can inject raw CRLF sequences into the query string, which are then sent as HTTP line breaks in the request target. This enables injection of arbitrary HTTP headers or splitting of the HTTP request. This issue affects hackney: from 0.13.1 before 4.0.1.",
    "evidence": "osv:CVE-2026-47075",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-47075",
      "aliases": [
        "CVE-2026-47075",
        "EEF-CVE-2026-47075",
        "GHSA-j9wq-vxxc-94wf"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/benoitc/hackney",
              "type": "GIT",
              "events": [
                {
                  "introduced": "8bb1a359a81ae58567c84f8d24564e9742e6f2bd"
                },
                {
                  "fixed": "ca73dd0aba0ed557449c18288bf07241671a43c9"
                },
                {
                  "introduced": "c5af75c883c10a036d5c8de15daacd1a3b7d27de"
                },
                {
                  "fixed": "c41c8d48ace8141b003f6f1de3ca6734a0c53056"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "8bb1a359a81ae58567c84f8d24564e9742e6f2bd"
                      },
                      {
                        "fixed": "ca73dd0aba0ed557449c18288bf07241671a43c9"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0.13.1"
                      },
                      {
                        "fixed": "4.0.1"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "ca73dd0aba0ed557449c18288bf07241671a43c9"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "4.0.0",
            "3.2.1",
            "3.2.0",
            "3.1.2",
            "3.1.1",
            "3.1.0",
            "3.0.3",
            "3.0.2",
            "3.0.1",
            "2.0.1",
            "2.0.0",
            "2.0.0-beta.1",
            "1.25.0",
            "1.24.1",
            "1.24.0",
            "1.23.0",
            "1.22.0",
            "1.21.0",
            "1.20.1",
            "1.20.0",
            "1.19.1",
            "1.19.0",
            "1.18.2",
            "1.18.1",
            "1.18.0",
            "1.17.4",
            "1.17.3",
            "1.17.2",
            "v1.17.0",
            "1.17.0",
            "1.17.1",
            "1.16.0",
            "0.16.0",
            "1.15.2",
            "1.15.1",
            "1.15.0",
            "1.14.3",
            "1.14.2",
            "1.14.0",
            "1.13.0",
            "1.12.1",
            "1.12.0",
            "1.11.0",
            "1.10.1",
            "1.10.0",
            "1.9.0",
            "1.8.6",
            "1.8.5",
            "1.8.4",
            "1.8.3",
            "1.8.2",
            "1.8.0",
            "1.7.1",
            "1.7.0",
            "1.6.6",
            "1.6.5",
            "1.6.4",
            "1.6.3",
            "1.6.2",
            "1.6.1",
            "1.6.0",
            "1.5.7",
            "1.5.6",
            "1.5.5",
            "1.5.4",
            "1.5.1",
            "1.5.0",
            "1.4.10",
            "1.4.9",
            "1.4.8",
            "1.4.7",
            "1.4.6",
            "1.4.5",
            "1.4.4",
            "1.4.3",
            "1.4.2",
            "1.4.1",
            "1.4.0",
            "1.3.2",
            "1.3.1",
            "1.3.0",
            "1.2.0",
            "1.1.0",
            "1.0.6",
            "1.0.5",
            "1.0.4",
            "1.0.3",
            "1.0.2",
            "1.0.1",
            "1.0.0",
            "0.15.2",
            "0.15.1",
            "0.15.0",
            "0.14.3",
            "0.14.2",
            "0.14.1",
            "0.14.0",
            "0.13.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47075.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:21.701978043Z",
      "provider": "osv",
      "references": [
        "https://cna.erlef.org/cves/CVE-2026-47075.html",
        "https://github.com",
        "https://osv.dev/vulnerability/EEF-CVE-2026-47075",
        "https://repo.hex.pm",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47075.json",
        "https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-47075",
        "https://github.com/benoitc/hackney/commit/ca73dd0aba0ed557449c18288bf07241671a43c9",
        "https://github.com/benoitc/hackney"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-93"
        ],
        "cna_assigner": "EEF",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47075.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-47075",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 487611,
  "published_at": "2026-05-25T14:00:45.781+00:00"
}