EEF-CVE-2026-47069

See a problem?
Please try reporting it to the source first.

Source

https://cna.erlef.org/osv/EEF-CVE-2026-47069.html

Import Source

https://cna.erlef.org/osv/EEF-CVE-2026-47069.json

JSON Data

https://api.osv.dev/v1/vulns/EEF-CVE-2026-47069

Aliases

CVE-2026-47069
GHSA-mp55-p8c9-rfw2

Published

2026-05-25T14:00:39.394Z

Modified

2026-05-26T19:46:39.859Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N CVSS Calculator

Summary

CRLF injection in cookie domain/path options in hackney

Details

Summary

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Response Splitting. The hackneycookie:setcookie/3 function in src/hackneycookie.erl validates the Name and Value arguments against CRLF and control characters, but concatenates the domain and path options verbatim into the output iolist with no equivalent check. An attacker who controls either option — for example by supplying a Host header value forwarded as the cookie domain, or a request path forwarded as the cookie path — can inject a literal CRLF sequence and arbitrary additional Set-Cookie headers into the HTTP response.

This issue affects hackney: from 0.9.0 before 4.0.1.

Database specific

{
    "cpe_ids": [
        "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
    ],
    "cwe_ids": [
        "CWE-93"
    ],
    "capec_ids": [
        "CAPEC-34"
    ]
}

References

Credits

- Peter Ullrich - FINDER
- Benoit Chesneau - REMEDIATION_DEVELOPER
- Jonatan Männchen - ANALYST

Affected packages

Hex / hackney

Package

Name: hackney
Purl: pkg:hex/hackney

Affected ranges

Type: SEMVER
Events: Introduced

0.9.0

Fixed

4.0.1

Affected versions

0.*

0.13.1

0.14.0

0.14.1

0.14.2

0.14.3

0.15.0

0.15.2

1.*

1.0.1

1.0.2

1.0.5

1.0.6

1.1.0

1.2.0

1.3.0

1.3.1

1.3.2

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.4.10

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.7.0

1.7.1

1.8.0

1.8.2

1.8.3

1.8.4

1.8.5

1.8.6

1.9.0

1.10.0

1.10.1

1.11.0

1.12.0

1.12.1

1.13.0

1.14.0

1.14.2

1.14.3

1.15.0

1.15.1

1.15.2

1.16.0

1.17.0

1.17.1

1.17.2

1.17.3

1.17.4

1.18.0

1.18.1

1.18.2

1.19.0

1.19.1

1.20.0

1.20.1

1.21.0

1.22.0

1.23.0

1.24.0

1.24.1

1.25.0

2.*

2.0.0-beta.1

2.0.0

2.0.1

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.1.0

3.1.1

3.1.2

3.2.0

3.2.1

4.*

4.0.0

Database specific

source

"https://cna.erlef.org/osv/EEF-CVE-2026-47069.json"

Git / github.com/benoitc/hackney