HTTP Request Splitting Vulnerability in Hackney by BenoitC

CVE-2026-112880

What is CVE-2026-112880?

The hackney library contains an HTTP Request Splitting vulnerability due to improper handling of CRLF sequences in the Proxy-Authorization header. When a request is made with a proxy, the library unnecessarily allows the inclusion of attacker-controlled characters such as carriage return (CR), line feed (LF), or null (NUL) bytes in the response from the proxy authentication function. This oversight can lead to the injection of additional HTTP headers, which could be exploited by malicious actors. The vulnerability particularly affects versions of hackney from 2.0.0 up to but not including 4.9.0, when this issue is patched.

References