CVE-2026-47072

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-47072
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Request/Response Splitting. The WebSocket upgrade code in src/hackney_ws.erl copies the host, path, headers (ExtraHeaders), and protocols options from the caller-supplied opts map into the internal #ws_data{} record in init/1 and then splices them verbatim into the raw HTTP/1.1 upgrade request by binary concatenation in do_handshake/1. No CRLF or NUL stripping is performed at any of these four injection sites. An attacker who controls any of these options — for example by forwarding URL components or header values from untrusted input into hackney_ws:start_link/1 — can inject arbitrary HTTP headers into the outbound WebSocket upgrade request, leading to header injection, credential spoofing toward the upstream server, log and cache poisoning, or request smuggling via intermediary proxies. This issue affects hackney: from 2.0.0 before 4.0.1.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cna.erlef.org/cves/CVE-2026-47072.html Patch Third Party Advisory
https://github.com/benoitc/hackney/commit/52310ca807e7b48441ba0e9129171f535313fdd1 Patch
https://github.com/benoitc/hackney/security/advisories/GHSA-f9vr-g2g2-x9fg Exploit Patch Vendor Advisory
https://osv.dev/vulnerability/EEF-CVE-2026-47072 Patch Third Party Advisory
https://github.com/benoitc/hackney/security/advisories/GHSA-f9vr-g2g2-x9fg Exploit Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*
History

28 May 2026, 20:27

Type Values Removed Values Added
CPE cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*
References () https://cna.erlef.org/cves/CVE-2026-47072.html - () https://cna.erlef.org/cves/CVE-2026-47072.html - Patch, Third Party Advisory
References () https://github.com/benoitc/hackney/commit/52310ca807e7b48441ba0e9129171f535313fdd1 - () https://github.com/benoitc/hackney/commit/52310ca807e7b48441ba0e9129171f535313fdd1 - Patch
References () https://github.com/benoitc/hackney/security/advisories/GHSA-f9vr-g2g2-x9fg - () https://github.com/benoitc/hackney/security/advisories/GHSA-f9vr-g2g2-x9fg - Exploit, Patch, Vendor Advisory
References () https://osv.dev/vulnerability/EEF-CVE-2026-47072 - () https://osv.dev/vulnerability/EEF-CVE-2026-47072 - Patch, Third Party Advisory
First Time Benoitc
Benoitc hackney
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

26 May 2026, 17:16

Type Values Removed Values Added
References () https://github.com/benoitc/hackney/security/advisories/GHSA-f9vr-g2g2-x9fg - () https://github.com/benoitc/hackney/security/advisories/GHSA-f9vr-g2g2-x9fg -

25 May 2026, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-05-25 15:16

Updated : 2026-05-28 20:27

NVD link : CVE-2026-47072

Mitre link : CVE-2026-47072

CVE.ORG link : CVE-2026-47072

JSON object : View

Products Affected

benoitc

  • hackney
CWE
CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')