CRLF Injection Vulnerability in Hackney WebSocket Upgrade

CVE-2026-47072

What is CVE-2026-47072?

The vulnerability in Hackney arises from inadequate handling of CRLF sequences, allowing attackers to perform HTTP Request/Response Splitting. By exploiting this flaw, an unauthorized entity can inject arbitrary HTTP headers during the WebSocket upgrade process. Since the upgrade request constructs are formed without sufficient checks on user-supplied input, an attacker can leverage this to manipulate header values, cause log and cache poisoning, and potentially execute request smuggling. This vulnerability emphasizes the importance of adequate input validation and safe handling of request parameters to safeguard applications using Hackney.

References