CVE-2026-112880

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback returns. After a 407 response from an HTTP CONNECT proxy, hackney_http_connect:handle_proxy_auth/11 calls the caller's proxy_auth_fun with the status code and the response headers and writes the returned binary into the Proxy-Authorization line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy. The value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy's challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes. This issue affects hackney: from 2.0.0 before 4.9.0.

• CWE-113

• https://cna.erlef.org/cves/CVE-2026-112880.html
• https://github.com/benoitc/hackney/commit/5df5a74a2817d5b12880d217db33253ff1fae1b5
• https://github.com/benoitc/hackney/commit/5ee7d7d19eba27e774667d472feb1e93a08af7f9
• https://github.com/benoitc/hackney/pull/989
• https://github.com/benoitc/hackney/releases/tag/4.9.0
• https://osv.dev/vulnerability/EEF-CVE-2026-112880

Published

Oct 26, 2026

Last Modified

Oct 26, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-112866Improper Neutralization of Special Elements used in an SQL C…9.3
• CVE-2026-112867Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2026-112868Authorization Bypass Through User-Controlled Key vulnerabili…4.3
• CVE-2026-112869Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2026-11287Insufficient policy enforcement in Navigation in Google Chro…6.5
• CVE-2026-11288Insufficient policy enforcement in CSS in Google Chrome prio…6.5
• CVE-2026-112887Gitea Actions task tokens authenticate to the REST API as a …
• CVE-2026-11289Side-channel information leakage in Paint in Google Chrome p…6.5
• CVE-2026-112891Pillow is a Python imaging library. From 9.2.0 until 13.0.0,…7.5
• CVE-2026-112892Pillow is a Python imaging library. From 4.1.0 until 13.0.0,…7.5
• CVE-2026-112893Pillow is a Python imaging library. From 10.0.0 until 13.0.0…7.5
• CVE-2026-112894Pillow is a Python imaging library. From 5.1.0 until 13.0.0,…7.5