CVE-2026-47075

MEDIUM EPSS 33.8%
Published May 25, 20261mo ago · Modified Jun 17, 20261w ago
6.8 CVSS 4.0
Medium
Find Similar
Published May 25, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago

Description

Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r) or line feed (\n) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar defined in RFC 3986 Section 3.4 must be percent-encoded, but hackney_url:make_url/3 passes the query binary directly without validation or escaping. An attacker who can control all or part of a URL passed to hackney can inject raw CRLF sequences into the query string, which are then sent as HTTP line breaks in the request target. This enables injection of arbitrary HTTP headers or splitting of the HTTP request. This issue affects hackney: from 0 before 4.0.1.

CVSS Details

Base Score
6.8
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction A
Scope X

Threat Intelligence

EPSS Exploit Probability
33.8% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-93

Affected Products 1

VendorProductVersionRange
benoitchackney* <4.0.1

References 4

  • cna.erlef.org https://cna.erlef.org/cves/CVE-2026-47075.html
    PatchThird Party Advisory
  • github.com https://github.com/benoitc/hackney/commit/ca73dd0aba0ed557449c18288bf07241671a43c9
    Patch
  • github.com https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf
    ExploitPatchVendor Advisory
  • osv.dev https://osv.dev/vulnerability/EEF-CVE-2026-47075
    PatchThird Party Advisory

Remediation

  • cna.erlef.org https://cna.erlef.org/cves/CVE-2026-47075.html
    PatchThird Party Advisory
  • github.com https://github.com/benoitc/hackney/commit/ca73dd0aba0ed557449c18288bf07241671a43c9
    Patch
  • github.com https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf
    ExploitPatchVendor Advisory
  • osv.dev https://osv.dev/vulnerability/EEF-CVE-2026-47075
    PatchThird Party Advisory