CVE-2026-47075

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-47075
Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r) or line feed (\n) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar defined in RFC 3986 Section 3.4 must be percent-encoded, but hackney_url:make_url/3 passes the query binary directly without validation or escaping. An attacker who can control all or part of a URL passed to hackney can inject raw CRLF sequences into the query string, which are then sent as HTTP line breaks in the request target. This enables injection of arbitrary HTTP headers or splitting of the HTTP request. This issue affects hackney: from 0 before 4.0.1.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cna.erlef.org/cves/CVE-2026-47075.html Patch Third Party Advisory
https://github.com/benoitc/hackney/commit/ca73dd0aba0ed557449c18288bf07241671a43c9 Patch
https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf Exploit Patch Vendor Advisory
https://osv.dev/vulnerability/EEF-CVE-2026-47075 Patch Third Party Advisory
https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf Exploit Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*
History

28 May 2026, 20:26

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References () https://cna.erlef.org/cves/CVE-2026-47075.html - () https://cna.erlef.org/cves/CVE-2026-47075.html - Patch, Third Party Advisory
References () https://github.com/benoitc/hackney/commit/ca73dd0aba0ed557449c18288bf07241671a43c9 - () https://github.com/benoitc/hackney/commit/ca73dd0aba0ed557449c18288bf07241671a43c9 - Patch
References () https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf - () https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf - Exploit, Patch, Vendor Advisory
References () https://osv.dev/vulnerability/EEF-CVE-2026-47075 - () https://osv.dev/vulnerability/EEF-CVE-2026-47075 - Patch, Third Party Advisory
First Time Benoitc
Benoitc hackney
CPE cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*

26 May 2026, 17:16

Type Values Removed Values Added
References () https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf - () https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf -

25 May 2026, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-05-25 15:16

Updated : 2026-05-28 20:26

NVD link : CVE-2026-47075

Mitre link : CVE-2026-47075

CVE.ORG link : CVE-2026-47075

JSON object : View

Products Affected

benoitc

  • hackney
CWE
CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')