CVE-2026-47075

Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r) or line feed (\n) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar defined in RFC 3986 Section 3.4 must be percent-encoded, but hackney_url:make_url/3 passes the query binary directly without validation or escaping. An attacker who can control all or part of a URL passed to hackney can inject raw CRLF sequences into the query string, which are then sent as HTTP line breaks in the request target. This enables injection of arbitrary HTTP headers or splitting of the HTTP request. This issue affects hackney: from 0.13.1 before 4.0.1.

• CWE-93

• https://cna.erlef.org/cves/CVE-2026-47075.htmlPatch, Third Party Advisory
• https://github.com/benoitc/hackney/commit/ca73dd0aba0ed557449c18288bf07241671a43c9Patch
• https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wfExploit, Patch, Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-47075Patch, Third Party Advisory
• https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wfExploit, Patch, Vendor Advisory

Published

May 25, 2026

Last Modified

Jul 24, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4707Incorrect boundary conditions in the Graphics: Canvas2D comp…7.5
• CVE-2026-47070Sensitive Data Exposure vulnerability in benoitc hackney all…6.1
• CVE-2026-47071Uncontrolled Resource Consumption vulnerability in benoitc h…7.5
• CVE-2026-47072Improper Neutralization of CRLF Sequences ('CRLF Injection')…7.5
• CVE-2026-47073Allocation of Resources Without Limits or Throttling vulnera…7.5
• CVE-2026-47074Improper Certificate Validation vulnerability in ex-aws ex_a…8.7
• CVE-2026-47076Interpretation Conflict vulnerability in benoitc hackney all…6.5
• CVE-2026-47077Allocation of Resources Without Limits or Throttling vulnera…7.5
• CVE-2026-47078Relative Path Traversal vulnerability in Erlang OTP (stdlib …4.8
• CVE-2026-4708Incorrect boundary conditions in the Graphics component. Thi…7.5
• CVE-2026-47081An issue was discovered in cyrus-imapd in Cyrus IMAP through…3.1
• CVE-2026-47082An issue was discovered in cyrus-imapd in Cyrus IMAP through…5.4