Description
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback returns. After a 407 response from an HTTP CONNECT proxy, hackney_http_connect:handle_proxy_auth/11 calls the caller's proxy_auth_fun with the status code and the response headers and writes the returned binary into the Proxy-Authorization line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy.

The value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy's challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes.

This issue affects hackney: from 2.0.0 before 4.9.0.
Published: 2026-10-26
Score: 2.1 Low
EPSS: n/a
KEV: No
Impact: HTTP Request/Response Splitting
Action: Patch
AI Analysis

Impact

The vulnerability results from hackney not sanitizing CR, LF, or NUL bytes in the value returned by the user supplied proxy_auth_fun. These control characters are written directly into the Proxy-Authorization header of an HTTP CONNECT retry, allowing an attacker to inject additional header lines and split the request sent to the proxy. This flaw constitutes HTTP Request/Response Splitting as described by CWE‑113.

Affected Systems

The issue affects the Elixir HTTP client library hackney version 2.0.0 through, but not including, 4.9.0, maintained by benoitc.

Risk and Exploitability

The CVSS score of 2.1 indicates a low severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires the attacker to influence the proxy_auth_fun callback, typically by controlling the proxy challenge headers from which the callback derives the authorization value. The low severity reflects the limited scope of the impact and the lack of easily exploitable conditions in most environments, yet the absence of input validation in a widely used library warrants timely patching.

Generated by OpenCVE AI on October 26, 2026 at 15:51 UTC.

Remediation

Vendor Workaround

Check the value your proxy_auth_fun is about to return for CR, LF and NUL bytes and return {error, Reason} instead when one is present. The callback runs in the application, so the check can be made there.

OpenCVE Recommended Actions

  • Upgrade hackney to version 4.9.0 or later, which includes validation of the proxy_auth_fun return value.
  • If an upgrade is not immediately possible, modify your proxy_auth_fun implementation to reject any string containing CR, LF or NUL bytes and return {error, Reason} before delegating to hackney.
  • Audit any third‑party modules that provide proxy_auth_fun to ensure they perform the same input sanitization or add defensive filtering around the header insertion point if it is not already present.

Generated by OpenCVE AI on October 26, 2026 at 15:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 26 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback returns. After a 407 response from an HTTP CONNECT proxy, hackney_http_connect:handle_proxy_auth/11 calls the caller's proxy_auth_fun with the status code and the response headers and writes the returned binary into the Proxy-Authorization line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy. The value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy's challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes. This issue affects hackney: from 2.0.0 before 4.9.0.
Title CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney
First Time appeared Benoitc
Benoitc hackney
Weaknesses CWE-113
CPEs cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*
Vendors & Products Benoitc
Benoitc hackney
References
Metrics cvssV4_0

{'score': 2.1, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N'}

Subscriptions

Benoitc Hackney
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-10-26T15:35:50.632Z

Reserved: 2026-10-26T10:15:01.166Z

Link: CVE-2026-112880

cve-icon Vulnrichment

Updated: 2026-10-26T15:32:18.053Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-26T14:16:28.440

Modified: 2026-10-26T16:59:16.113

Link: CVE-2026-112880

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T16:00:18Z

Weaknesses
  • CWE-113

    Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')