CVE-2026-47069: CRLF injection in cookie domain/path options in hackney
Summary
CRLF injection in hackneycookie:setcookie/3 (src/hackneycookie.erl). The function validates Name and Value against CR/LF and control characters but concatenates the domain and path options verbatim into the output binary. If either option carries attacker-controlled data, a Host header forwarded as the cookie domain, a request URI forwarded as the cookie path, a \r\n in the value splits the Set-Cookie header and lets the attacker inject additional headers into the HTTP response.
Details
1. Asymmetric validation
Lines 27–34 of hackneycookie.erl run binary:match on Name and Value, rejecting =, ,, ;, whitespace, \r, \n, \013, and \014. The Domain and Path options (lines 47 and 51) skip this check entirely and land straight in the result iolist:
erlang [<<"; Domain=">>, Domain] [<<"; Path=">>, Path]
iolisttobinary(...) on line 63 flattens everything and returns it to the caller.
2. Injection
A Path of <<"/x\r\nSet-Cookie: admin=1; Path=/">> produces a binary with a literal \r\n. Written into a Set-Cookie response header, the receiving HTTP parser splits it into two headers — one legitimate, one attacker-controlled.
3. Realistic trigger
Common patterns: keying the cookie domain off Host, deriving the path from the request URI, or copying a Location path into a cookie. Any of these lets a remote attacker control the injected content.
PoC
1. Call hackneycookie:setcookie(<<"sid">>, <<"abc">>, [{path, <<"/x\r\nSet-Cookie: admin=1; Path=/">>}]). 2. The returned binary contains a literal \r\n followed by a second Set-Cookie: line. 3. Write the result into a Set-Cookie response header — the client parses two headers, including admin=1.
Impact
Cookie injection / HTTP response splitting at the hackneycookie API boundary. Affects hackney 0.9.0 through 4.0.0 wherever domain or path options are populated from request data. Exploitation can overwrite session/auth cookies, fix cookies, or strip Secure/HttpOnly flags. CVSS v4.0: 2.1 (LOW) — requires attacker-controlled input to reach the domain or path option.
Resources
Introduction commit: https://github.com/benoitc/hackney/commit/602d5c7f2ea4acbc83ed75230655d935a0750ebc Patch commit: https://github.com/benoitc/hackney/commit/8e02b99c28aea1b3fa2ddc0e66f51fe5bb0ac540
Other sources
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Response Splitting. The hackneycookie:setcookie/3 function in src/hackneycookie.erl validates the Name and Value arguments against CRLF and control characters, but concatenates the domain and path options verbatim into the output iolist with no equivalent check. An attacker who controls either option — for example by supplying a Host header value forwarded as the cookie domain, or a request path forwarded as the cookie path — can inject a literal CRLF sequence and arbitrary additional Set-Cookie headers into the HTTP response.
This issue affects hackney: from 0.9.0 before 4.0.1.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
erlang/hackneyto a version that resolves this vulnerability.Fixed in 4.0.1 - Upgrade
Upgrade
benoitc/hackneyto a version that resolves this vulnerability.Fixed in 4.0.1 - Configuration
Ensure the values passed to hackney_cookie:setcookie/3 for the `domain` and `path` options are not derived from user-controlled request components (such as forwarded Host header or request path/URI). The issue affects hackney 0.9.0 through 4.0.0 where domain/path are populated from request data and can contain attacker-controlled CRLF ("\r\n").
hackney_cookie:setcookie/3 cookie Domain and Path options (domain/path) = Do not populate Domain or Path from attacker-controlled request data (e.g., Host header, request URI) - Compensating control
If you rely on cookies set by hackney and any headers are user influenced, deploy HTTP header protections at the edge (e.g., WAF/ingress controls) to block requests that contain CRLF sequences in fields that may be used to populate cookie `domain` or `path`.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47069?
CVE-2026-47069 has a severity rating of low, with a CVSS score of 4.0.
How do I fix CVE-2026-47069?
To fix CVE-2026-47069, apply the available patch from the hackney project.
What type of vulnerability is CVE-2026-47069?
CVE-2026-47069 is a CRLF injection vulnerability that allows HTTP Response Splitting.
Which software is affected by CVE-2026-47069?
CVE-2026-47069 affects the benoitc hackney HTTP client.
When was CVE-2026-47069 published?
CVE-2026-47069 was published on May 25, 2026.