CVE-2026-47072

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Request/Response Splitting. The WebSocket upgrade code in src/hackney_ws.erl copies the host, path, headers (ExtraHeaders), and protocols options from the caller-supplied opts map into the internal #ws_data{} record in init/1 and then splices them verbatim into the raw HTTP/1.1 upgrade request by binary concatenation in do_handshake/1. No CRLF or NUL stripping is performed at any of these four injection sites. An attacker who controls any of these options — for example by forwarding URL components or header values from untrusted input into hackney_ws:start_link/1 — can inject arbitrary HTTP headers into the outbound WebSocket upgrade request, leading to header injection, credential spoofing toward the upstream server, log and cache poisoning, or request smuggling via intermediary proxies. This issue affects hackney: from 2.0.0 before 4.0.1.

• CWE-93

• https://cna.erlef.org/cves/CVE-2026-47072.htmlPatch, Third Party Advisory
• https://github.com/benoitc/hackney/commit/52310ca807e7b48441ba0e9129171f535313fdd1Patch
• https://github.com/benoitc/hackney/security/advisories/GHSA-f9vr-g2g2-x9fgExploit, Patch, Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-47072Patch, Third Party Advisory
• https://github.com/benoitc/hackney/security/advisories/GHSA-f9vr-g2g2-x9fgExploit, Patch, Vendor Advisory

Published

May 25, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47067Allocation of Resources Without Limits or Throttling vulnera…7.5
• CVE-2026-47068Authorization Bypass Through User-Controlled Key vulnerabili…2.3
• CVE-2026-47069Improper Neutralization of CRLF Sequences ('CRLF Injection')…5.3
• CVE-2026-4707Incorrect boundary conditions in the Graphics: Canvas2D comp…7.5
• CVE-2026-47070Sensitive Data Exposure vulnerability in benoitc hackney all…6.1
• CVE-2026-47071Uncontrolled Resource Consumption vulnerability in benoitc h…7.5
• CVE-2026-47073Allocation of Resources Without Limits or Throttling vulnera…7.5
• CVE-2026-47074Improper Certificate Validation vulnerability in ex-aws ex_a…8.7
• CVE-2026-47075Improper Neutralization of CRLF Sequences vulnerability in b…7.5
• CVE-2026-47076Interpretation Conflict vulnerability in benoitc hackney all…6.5
• CVE-2026-47077Allocation of Resources Without Limits or Throttling vulnera…7.5
• CVE-2026-47078Relative Path Traversal vulnerability in Erlang OTP (stdlib …4.8