The vulnerability is an Improper Neutralization of CRLF Sequences in hackney, which allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r) or line feed (\n) characters in the URL query component before constructing the HTTP/1.1 request target. Because hackney_url:make_url/3 passes the query binary directly without validation or escaping, raw CRLF sequences supplied by an attacker become real line breaks in the request line. This permits HTTP Request Splitting, allowing the injection of arbitrary HTTP headers or the division of a single request into multiple requests to downstream services. The loss of control over outbound requests could compromise confidentiality or integrity of data in transit. The description does not detail specific privilege-escalation or exfiltration scenarios, so the impact is inferred as a serious communication-layer vulnerability with potential downstream effects.

Vendor benoitc, Product hackney. Versions from 0.13.1 up to, but not including, 4.0.1 are affected. The flaw exists in any version where the URL query string is concatenated into the request without percent‑encoding.

The CVSS score of 6.8 indicates medium severity. An attacker who can supply a controlled URL to the library can exploit the issue, as the flaw requires only the ability to inject CR and LF characters into the query string. The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. However, the possibility of inserting arbitrary headers poses a significant threat to applications that rely on hackney for communicating with trusted services, thus the risk should be treated as non‑negligible.