PT-2026-43071 · Hackney · Hackney

Benoit Chesneau + 2 · Published 2026-05-25 · Updated 2026-06-26 · CVE-2026-47075

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions hackney versions 0 through 4.0.0

Description Improper Neutralization of CRLF Sequences allows HTTP Request Splitting. The software fails to percent-encode carriage return (r) or line feed ( ) characters in the URL query component before constructing the HTTP/1.1 request target. Specifically, the hackney url:make url/3 function passes the query binary directly without validation or escaping, violating RFC 3986 Section 3.4. An attacker controlling part of a URL can inject raw CRLF sequences into the query string, enabling the injection of arbitrary HTTP headers or the splitting of the HTTP request.

Recommendations Update to version 4.0.1.

Exploit

Fix

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2026-47075

GHSA-J9WQ-VXXC-94WF

Affected Products

Hackney

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47075.json · Exploit
• 🔥 https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf · Exploit
• https://github.com/benoitc/hackney/commit/ca73dd0aba0ed557449c18288bf07241671a43c9 · Patch
• https://osv.dev/vulnerability/CVE-2026-47075 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j9wq-vxxc-94wf · Vendor Advisory
• https://cna.erlef.org/cves/CVE-2026-47075.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-47075 · Security Note
• https://github.com/benoitc/hackney · Note
• https://github.com · Note
• https://hex.pm/packages/hackney · Note
• https://repo.hex.pm · Note
• https://osv.dev/vulnerability/EEF-CVE-2026-47075 · Vendor Advisory, Patch
• https://twitter.com/dailycve/status/2060188361155809557 · Twitter Post