CVE-2026-47075: Benoitc Hackney vulnerability (CVSS 7.5)

Description

Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r) or line feed (\n) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar defined in RFC 3986 Section 3.4 must be percent-encoded, but hackney_url:make_url/3 passes the query binary directly without validation or escaping. An attacker who can control all or part of a URL passed to hackney can inject raw CRLF sequences into the query string, which are then sent as HTTP line breaks in the request target. This enables injection of arbitrary HTTP headers or splitting of the HTTP request. This issue affects hackney: from 0.13.1 before 4.0.1.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityNone

IntegrityHigh

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Benoitc Hackney< 4.0.1

Remediation

Fixed in

Benoitc Hackney≥ 4.0.1

Patch & vendor advisories

References

https://cna.erlef.org/cves/CVE-2026-47075.htmlPatchThird Party Advisory
https://github.com/benoitc/hackney/commit/ca73dd0aba0ed557449c18288bf07241671a43c9Patch
https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wfExploitPatchVendor Advisory
https://osv.dev/vulnerability/EEF-CVE-2026-47075PatchThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-47075 being actively exploited?

CVE-2026-47075 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.42%.

How severe is CVE-2026-47075?

CVE-2026-47075 has a CVSS 3.1 base score of 7.5, rated high. EPSS estimates a 0.42% probability of exploitation.

Which products are affected by CVE-2026-47075?

Affected products include Benoitc Hackney.

How do I fix CVE-2026-47075?

Upgrade affected software to a fixed version, for example Benoitc Hackney 4.0.1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-47075 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo