CVE-2026-47069: fallo de gravedad baja en benoitc hackney
CRLF injection in cookie domain/path options in hackney
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
8Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 2.1epss 0.4%
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Response Splitting. The hackney_cookie:setcookie/3 function in src/hackney_cookie.erl validates the Name and Value arguments against CRLF and control characters, but concatenates the domain and path options verbatim into the output iolist with no equivalent check. An attacker who controls either option — for example by supplying a Host header value forwarded as the cookie domain, or a request path forwarded as the cookie path — can inject a literal CRLF sequence and arbitrary additional Set-Cookie headers into the HTTP response.
This issue affects hackney: from 0.9.0 before 4.0.1.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Productos afectados
benoitc · hackneyCVEs relacionadas — benoitc hackney
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-47073HIGHUnbounded memory consumption in WebSocket client in hackneyEPSS 0.9%CVE-2026-47067HIGHAtom table exhaustion via unrecognized URL schemes in hackneyEPSS 0.8%CVE-2026-47071HIGHSOCKS5 TLS upgrade ignores caller timeout in hackneyEPSS 0.8%CVE-2026-47066HIGHInfinite loop in Alt-Svc header parser in hackneyEPSS 0.8%CVE-2026-47077HIGHUnbounded body accumulation in HTTP/3 response loop in hackneyEPSS 0.7%CVE-2026-97200HIGHUnbounded response body buffering and decompression in hackneyEPSS 0.6%