CVE-2026-112880
Awaiting Analysis Awaiting Analysis - Queue

HTTP Header Injection in Hackney HTTP Client

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: EEF

Description
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback returns. After a 407 response from an HTTP CONNECT proxy, hackney_http_connect:handle_proxy_auth/11 calls the caller's proxy_auth_fun with the status code and the response headers and writes the returned binary into the Proxy-Authorization line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy. The value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy's challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes. This issue affects hackney: from 2.0.0 before 4.9.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-112880
EUVD
EUVD-2026-109833

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
benoitc hackney 2.0.0
benoitc hackney 5df5a74a2817d5b12880d217db33253ff1fae1b5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-113 The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-112880 is an HTTP Request/Response Splitting vulnerability in the hackney library. When a 407 response is received from an HTTP CONNECT proxy, the proxy_auth_fun callback processes response headers and writes its return value into the Proxy-Authorization header without validation. If the callback returns a value containing CR, LF, or NUL characters, it can inject additional header lines into the request sent to the proxy.

Detection Guidance

To detect this vulnerability, inspect applications using hackney library versions before 4.9.0. Check if proxy_auth_fun callbacks process untrusted data and validate their output for CR, LF, or NUL characters. Review HTTP CONNECT proxy interactions for malformed headers or unexpected header injections.

Impact Analysis

This vulnerability allows attackers to manipulate HTTP requests by injecting malicious headers if the proxy_auth_fun callback uses untrusted data. This could lead to unauthorized access, session hijacking, or bypassing security controls. The impact is limited to systems using hackney versions 2.0.0 to 4.8.0 with the proxy_auth_fun option enabled.

Mitigation Strategies
  • Upgrade hackney library to version 4.9.0 or later to apply the CRLF neutralization fix.
  • If upgrading is not possible, validate proxy_auth_fun callback outputs to reject any values containing CR, LF, or NUL characters before using them in headers.
  • Monitor HTTP CONNECT proxy interactions for header injection attempts or malformed requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112880. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart