PT-2026-43066 · Hexpm · Hackney

Benoit Chesneau + 2 · Published 2026-05-25 · Updated 2026-06-26 · CVE-2026-47069

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions hackney versions 0.9.0 through 4.0.0

Description Improper Neutralization of CRLF Sequences, also known as CRLF Injection, allows HTTP Response Splitting. The setcookie/3 function in src/hackney cookie.erl validates Name and Value arguments against CRLF and control characters but concatenates the domain and path options into the output iolist without equivalent checks. An attacker controlling these options, such as by providing a Host header value as the cookie domain or a request path as the cookie path, can inject literal CRLF sequences and arbitrary additional Set-Cookie headers into the HTTP response.

Recommendations Update to version 4.0.1.

Exploit

Fix

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2026-47069

GHSA-MP55-P8C9-RFW2

Affected Products

Hackney

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47069.json · Exploit
• 🔥 https://github.com/benoitc/hackney/security/advisories/GHSA-mp55-p8c9-rfw2 · Exploit
• https://github.com/benoitc/hackney/commit/8e02b99c28aea1b3fa2ddc0e66f51fe5bb0ac540 · Patch
• https://cna.erlef.org/cves/CVE-2026-47069.html · Patch
• https://osv.dev/vulnerability/CVE-2026-47069 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47069 · Security Note
• https://osv.dev/vulnerability/GHSA-mp55-p8c9-rfw2 · Vendor Advisory
• https://github.com/benoitc/hackney · Note
• https://github.com · Note
• https://hex.pm/packages/hackney · Note
• https://osv.dev/vulnerability/EEF-CVE-2026-47069 · Vendor Advisory, Patch
• https://t.me/cveNotify/164839 · Telegram Post
• https://repo.hex.pm · Note