The vulnerability originates from the WebSocket upgrade logic in the hackney library, where the host, path, headers, and protocols options supplied via the opts map are concatenated directly into the raw HTTP/1.1 upgrade request without any sanitization. This design flaw enables an attacker who can inject CRLF or NUL bytes into any of these fields to perform CRLF injection, allowing arbitrary HTTP header injection. Such header injection can be used for credential spoofing against upstream servers, log or cache poisoning, or request smuggling through intermediary proxies. The weakness is classified as CWE‑93 (Improper Neutralization of CRLF Sequences).

The affected product is the Erlang/OTP HTTP client library hackney, in all releases from version 2.0.0 up to, but not including, 4.0.1. The fix is available in version 4.0.1 and later. No further sub‑product distinctions are indicated.

The CVSS base score of 6.9 indicates a moderate impact. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker can influence the opts map passed to hackney_ws:start_link/1, which typically means control over part of the WebSocket client request. No public exploits have been documented yet, but the possibility of header injection, credential spoofing, and request smuggling presents a credible threat in environments where untrusted input may reach the library.