CVE-2026-47069 Details
Description
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Response Splitting. The hackney_cookie:setcookie/3 function in src/hackney_cookie.erl validates the Name and Value arguments against CRLF and control characters, but concatenates the domain and path options verbatim into the output iolist with no equivalent check. An attacker who controls either option — for example by supplying a Host header value forwarded as the cookie domain, or a request path forwarded as the cookie path — can inject a literal CRLF sequence and arbitrary additional Set-Cookie headers into the HTTP response. This issue affects hackney: from 0.9.0 before 4.0.1.
A CRLF injection vulnerability has been identified in the benoitc hackney library, specifically in versions 0.9.0 prior to 4.0.1. This vulnerability allows for HTTP response splitting by improperly validating CRLF sequences in cookie domain and path options. The issue arises in the hackney_cookie:setcookie/3 function, which correctly sanitizes the Name and Value parameters but fails to apply the same checks to the domain and path options. As a result, an attacker can inject CRLF sequences and additional Set-Cookie headers into the HTTP response by manipulating these options.
Users can upgrade to hackney version 4.0.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/benoitc/hackney/security/advisories/GHSA-mp55-p8c9-rfw2 | CISA-ADP | ExploitPatchVendor Advisory |
| https://cna.erlef.org/cves/CVE-2026-47069.html | EEF | PatchThird Party Advisory |
| https://github.com/benoitc/hackney/commit/8e02b99c28aea1b3fa2ddc0e66f51fe5bb0ac540 | EEF | Patch |
| https://github.com/benoitc/hackney/security/advisories/GHSA-mp55-p8c9-rfw2 | EEF | ExploitPatchVendor Advisory |
| https://osv.dev/vulnerability/EEF-CVE-2026-47069 | EEF | PatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | EEF |
Affected Products
| Product | Versions |
|---|---|
| benoitc hackney | >= 0.9.0, < 4.0.1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | Initial Analysis | [email protected] |
| May 26, 2026 | CVE Modified | CISA-ADP |
| May 25, 2026 | New CVE Received | EEF |