CRLF Injection Vulnerability in Hackney HTTP Client by Benoit C

CVE-2026-47069

What is CVE-2026-47069?

An improper neutralization of CRLF sequences vulnerability exists in the Hackney HTTP client, which may allow attackers to exploit this flaw by injecting malicious CRLF sequences. The issue arises due to a lack of validation on the concatenation of domain and path options in cookie settings. Specifically, the hackney_cookie:setcookie/3 function does not adequately validate Name and Value arguments against CRLF and control characters. Consequently, attackers can manipulate the Host header or request path, leading to potential HTTP response splitting, which may facilitate the injection of arbitrary Set-Cookie headers.

References