CVE-2026-47069

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47069
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47069.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47069
Aliases
Published
2026-05-25T14:00:39.394Z
Modified
2026-07-27T03:56:23.720857922Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N CVSS Calculator
Summary
CRLF injection in cookie domain/path options in hackney
Details

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Response Splitting. The hackneycookie:setcookie/3 function in src/hackneycookie.erl validates the Name and Value arguments against CRLF and control characters, but concatenates the domain and path options verbatim into the output iolist with no equivalent check. An attacker who controls either option — for example by supplying a Host header value forwarded as the cookie domain, or a request path forwarded as the cookie path — can inject a literal CRLF sequence and arbitrary additional Set-Cookie headers into the HTTP response.

This issue affects hackney: from 0.9.0 before 4.0.1.

Database specific 
{
    "cwe_ids": [
        "CWE-93"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47069.json",
    "cna_assigner": "EEF",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "602d5c7f2ea4acbc83ed75230655d935a0750ebc"
                },
                {
                    "fixed": "8e02b99c28aea1b3fa2ddc0e66f51fe5bb0ac540"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/benoitc/hackney

Affected ranges

Type
GIT
Repo
https://github.com/benoitc/hackney
Events
Introduced
7011a86c4d6e9ca4a96784d05dda4d9cea14e768
Fixed
c41c8d48ace8141b003f6f1de3ca6734a0c53056
Fixed
8e02b99c28aea1b3fa2ddc0e66f51fe5bb0ac540
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0.9.0"
        },
        {
            "fixed": "4.0.1"
        }
    ],
    "cpe": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.10.0
0.10.1
0.11.0
0.11.1
0.11.2
0.12.0
0.12.1
0.13.0
0.13.1
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.16.0
0.9.0
0.9.1
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.1.0
1.10.0
1.10.1
1.11.0
1.12.0
1.12.1
1.13.0
1.14.0
1.14.2
1.14.3
1.15.0
1.15.1
1.15.2
1.16.0
1.17.0
1.17.1
1.17.2
1.17.3
1.17.4
1.18.0
1.18.1
1.18.2
1.19.0
1.19.1
1.2.0
1.20.0
1.20.1
1.21.0
1.22.0
1.23.0
1.24.0
1.24.1
1.25.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.10
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.0
1.5.1
1.5.4
1.5.5
1.5.6
1.5.7
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.1
1.8.0
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.9.0
2.*
2.0.0
2.0.0-beta.1
2.0.1
3.*
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.2.0
3.2.1
4.*
4.0.0
v1.*
v1.17.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47069.json"