CVE-2026-47075
CR/LF injection in query parameter in hackney
- Published
- Updated
- Reserved
- Assigned by
- EEF
Description
Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r) or line feed (\n) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar defined in RFC 3986 Section 3.4 must be percent-encoded, but hackney_url:make_url/3 passes the query binary directly without validation or escaping. An attacker who can control all or part of a URL passed to hackney can inject raw CRLF sequences into the query string, which are then sent as HTTP line breaks in the request target. This enables injection of arbitrary HTTP headers or splitting of the HTTP request. This issue affects hackney: from 0.13.1 before 4.0.1.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| EEFCNA (assigner) | 4.0 | Medium6.8 | CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N |
| NVDNVD · Modified | 4.0 | Medium6.8 | CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.48% · top 58% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.8.
Weakness
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- HexhackneyGHSA-j9wq-vxxc-94wf (opens in a new tab)
References (4)
- https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf (opens in a new tab)vendor-advisoryrelatedexploit
- https://cna.erlef.org/cves/CVE-2026-47075.html (opens in a new tab)related
- https://osv.dev/vulnerability/EEF-CVE-2026-47075 (opens in a new tab)related
- https://github.com/benoitc/hackney/commit/ca73dd0aba0ed557449c18288bf07241671a43c9 (opens in a new tab)patch
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-j9wq-vxxc-94wf (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-47075)Record last updated .