CVE-2026-47075: fallo de gravedad media en benoitc hackney
CR/LF injection in query parameter in hackney
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.8epss 0.5%
Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r) or line feed (\n) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar defined in RFC 3986 Section 3.4 must be percent-encoded, but hackney_url:make_url/3 passes the query binary directly without validation or escaping. An attacker who can control all or part of a URL passed to hackney can inject raw CRLF sequences into the query string, which are then sent as HTTP line breaks in the request target. This enables injection of arbitrary HTTP headers or splitting of the HTTP request.
This issue affects hackney: from 0.13.1 before 4.0.1.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
Productos afectados
benoitc · hackneyCVEs relacionadas — benoitc hackney
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-47073HIGHUnbounded memory consumption in WebSocket client in hackneyEPSS 0.9%CVE-2026-47067HIGHAtom table exhaustion via unrecognized URL schemes in hackneyEPSS 0.8%CVE-2026-47071HIGHSOCKS5 TLS upgrade ignores caller timeout in hackneyEPSS 0.8%CVE-2026-47066HIGHInfinite loop in Alt-Svc header parser in hackneyEPSS 0.8%CVE-2026-47077HIGHUnbounded body accumulation in HTTP/3 response loop in hackneyEPSS 0.7%CVE-2026-97200HIGHUnbounded response body buffering and decompression in hackneyEPSS 0.6%