The vulnerability arises because hackney does not percent‑encode carriage return and line feed characters that appear in the query component of a URL. When a query string containing raw CRLF characters is passed to hackney, those characters are transmitted as actual line breaks in the HTTP/1.1 request target. This enables HTTP Request Splitting, allowing an attacker to inject arbitrary HTTP headers, alter the request body, or split a single request into multiple requests directed to downstream services. The effect is a loss of control over the outbound request and gives attackers the opportunity to inject arbitrary headers that could influence downstream services. The extent to which this could lead to privilege‑escalation or data exfiltration is not explicitly detailed in the description, so those outcomes are inferred rather than directly stated.

Vendor benoitc, Product hackney. All releases from version 0 up to, but not including, 4.0.1 are affected. The flaw exists in any version where the URL query string is concatenated into the request without percent‑encoding.

The CVSS score of 6.8 indicates medium severity. An attacker who can supply a controlled URL to the library can exploit the issue, as the flaw requires only the ability to inject CR and LF characters into the query string. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. However, the possibility of inserting arbitrary headers poses a significant threat to applications that rely on hackney for communicating with trusted services, thus the risk should be treated as non‑negligible.