GHSA-j9wq-vxxc-94wf

Source

https://github.com/advisories/GHSA-j9wq-vxxc-94wf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-j9wq-vxxc-94wf/GHSA-j9wq-vxxc-94wf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-j9wq-vxxc-94wf

Aliases

Published

2026-06-26T21:58:59Z

Modified

2026-06-26T22:00:10.561300666Z

Severity

6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N CVSS Calculator

Summary

Hackney has CR/LF injection in query parameter

Details

Summary

hackney_url:make_url/3 passes the URL query component directly into the HTTP/1.1 request target without percent-encoding \r or \n. RFC 3986 §3.4 requires characters outside the query grammar to be percent-encoded, but no validation or escaping occurs. An attacker who controls any portion of the URL passed to hackney can inject raw CRLF sequences into the request line, enabling HTTP header injection or full request splitting.

Details

hackney_url:make_url/3 in src/hackney_url.erl builds the request target by concatenating the path and query binaries. The query string is used as-is — no character-class check, no percent-encoding of \r or \n. When hackney serializes the request, the query value lands verbatim in the GET <path>?<query> HTTP/1.1\r\n request line. A query value containing \r\n terminates the request line early; subsequent bytes are parsed by the server (or any intermediary proxy) as additional header lines or a second request.

A concrete example: a URL with query ?q=x HTTP/1.1\r\nX-Injected: yes\r\nX: produces the following on the wire:

GET /?q=x HTTP/1.1
X-Injected: yes
X: HTTP/1.1
Host: ...

The server sees X-Injected: yes as a legitimate request header that the client never intended to send.

PoC

Listen on a raw TCP port: nc -lvnp 8080.
Issue: :hackney.get("http://127.0.0.1:8080/?q=x HTTP/1.1\r\nX-Injected: yes\r\nX:").
Observe the listener receives X-Injected: yes as a standalone header line in the request.

Impact

HTTP header injection and request splitting against any server hackney connects to. Affects all released versions of hackney before 4.0.1. Exploitation requires an attacker-controlled URL (or URL component) to reach hackney without prior sanitization. Consequences include injecting arbitrary headers (Authorization, Host, X-Forwarded-For) and splitting requests through proxies. CVSS v4.0: 6.8 (MEDIUM).

Resources

Introduction commit: https://github.com/benoitc/hackney/commit/8bb1a359a81ae58567c84f8d24564e9742e6f2bd
Patch commit: https://github.com/benoitc/hackney/commit/ca73dd0aba0ed557449c18288bf07241671a43c9

Database specific

{
    "severity": "MODERATE",
    "nvd_published_at": "2026-05-25T15:16:22Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-93"
    ],
    "github_reviewed_at": "2026-06-26T21:58:59Z"
}

References

Affected packages

Hex / hackney

Package

Name: hackney
Purl: pkg:hex/hackney

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.0.1

Affected versions

0.*

0.13.1

0.14.0

0.14.1

0.14.2

0.14.3

0.15.0

0.15.2

1.*

1.0.1

1.0.2

1.0.5

1.0.6

1.1.0

1.2.0

1.3.0

1.3.1

1.3.2

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.4.10

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.7.0

1.7.1

1.8.0

1.8.2

1.8.3

1.8.4

1.8.5

1.8.6

1.9.0

1.10.0

1.10.1

1.11.0

1.12.0

1.12.1

1.13.0

1.14.0

1.14.2

1.14.3

1.15.0

1.15.1

1.15.2

1.16.0

1.17.0

1.17.1

1.17.2

1.17.3

1.17.4

1.18.0

1.18.1

1.18.2

1.19.0

1.19.1

1.20.0

1.20.1

1.21.0

1.22.0

1.23.0

1.24.0

1.24.1

1.25.0

2.*

2.0.0-beta.1

2.0.0

2.0.1

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.1.0

3.1.1

3.1.2

3.2.0

3.2.1

4.*

4.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-j9wq-vxxc-94wf/GHSA-j9wq-vxxc-94wf.json"