CVE-2026-47075: CR/LF injection in query parameter in hackney
Summary
hackneyurl:makeurl/3 passes the URL query component directly into the HTTP/1.1 request target without percent-encoding \r or \n. RFC 3986 §3.4 requires characters outside the query grammar to be percent-encoded, but no validation or escaping occurs. An attacker who controls any portion of the URL passed to hackney can inject raw CRLF sequences into the request line, enabling HTTP header injection or full request splitting.
Details
hackneyurl:makeurl/3 in src/hackneyurl.erl builds the request target by concatenating the path and query binaries. The query string is used as-is — no character-class check, no percent-encoding of \r or \n. When hackney serializes the request, the query value lands verbatim in the GET <path>?<query> HTTP/1.1\r\n request line. A query value containing \r\n terminates the request line early; subsequent bytes are parsed by the server (or any intermediary proxy) as additional header lines or a second request.
A concrete example: a URL with query ?q=x HTTP/1.1\r\nX-Injected: yes\r\nX: produces the following on the wire:
GET /?q=x HTTP/1.1 X-Injected: yes X: HTTP/1.1 Host: ...
The server sees X-Injected: yes as a legitimate request header that the client never intended to send.
PoC
1. Listen on a raw TCP port: nc -lvnp 8080. 2. Issue: :hackney.get("http://127.0.0.1:8080/?q=x HTTP/1.1\r\nX-Injected: yes\r\nX:"). 3. Observe the listener receives X-Injected: yes as a standalone header line in the request.
Impact
HTTP header injection and request splitting against any server hackney connects to. Affects all released versions of hackney before 4.0.1. Exploitation requires an attacker-controlled URL (or URL component) to reach hackney without prior sanitization. Consequences include injecting arbitrary headers (Authorization, Host, X-Forwarded-For) and splitting requests through proxies. CVSS v4.0: 6.8 (MEDIUM).
Resources
Introduction commit: https://github.com/benoitc/hackney/commit/8bb1a359a81ae58567c84f8d24564e9742e6f2bd Patch commit: https://github.com/benoitc/hackney/commit/ca73dd0aba0ed557449c18288bf07241671a43c9
Other sources
Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r) or line feed (\n) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar defined in RFC 3986 Section 3.4 must be percent-encoded, but hackneyurl:makeurl/3 passes the query binary directly without validation or escaping. An attacker who can control all or part of a URL passed to hackney can inject raw CRLF sequences into the query string, which are then sent as HTTP line breaks in the request target. This enables injection of arbitrary HTTP headers or splitting of the HTTP request.
This issue affects hackney: from 0 before 4.0.1.
— NVD
Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r) or line feed (\n) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar defined in RFC 3986 Section 3.4 must be percent-encoded, but hackneyurl:makeurl/3 passes the query binary directly without validation or escaping. An attacker who can control all or part of a URL passed to hackney can inject raw CRLF sequences into the query string, which are then sent as HTTP line breaks in the request target. This enables injection of arbitrary HTTP headers or splitting of the HTTP request.
This issue affects hackney: from 0.13.1 before 4.0.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
erlang/hackneyto a version that resolves this vulnerability.Fixed in 4.0.1 - Upgrade
Upgrade
hackneyto a version that resolves this vulnerability.Fixed in 4.0.1 - Configuration
Modify/override hackney_url:make_url/3 so that the URL query component is not passed verbatim; specifically, percent-encode any carriage return (\r) and line feed (\n) bytes in the query before concatenating it into the `GET <path>?<query> HTTP/1.1\r\n` request line.
hackney_url:make_url/3 (src/hackney_url.erl) URL query handling = Percent-encode CR (%0D) and LF (%0A) characters in the query before constructing the HTTP/1.1 request target - Compensating control
Ensure attacker-controlled URLs passed to hackney are not allowed to contain raw CRLF sequences (e.g., validate/normalize input to prevent `\r` and `\n` characters in URL query parameters) so that request splitting/header injection payloads like `...?q=x HTTP/1.1\r\nX-Injected: yes\r\nX:` cannot reach hackney un-sanitized.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47075?
CVE-2026-47075 has been assigned a risk severity score of 53.
What is CVE-2026-47075?
CVE-2026-47075 refers to a CR/LF injection vulnerability in the hackney library, which allows for HTTP request splitting.
How do I fix CVE-2026-47075?
To fix CVE-2026-47075, ensure that the hackney library is updated to a version that properly percent-encodes CR and LF characters in HTTP request targets.
Which software is affected by CVE-2026-47075?
CVE-2026-47075 affects the hex/hackney software library.
What types of attacks could CVE-2026-47075 enable?
CVE-2026-47075 could enable attacks like HTTP response splitting, which might lead to web cache poisoning or other security issues.