CVE-2026-47072
CRLF Injection in hackney WebSocket Upgrade
Publication date: 2026-05-25
Last updated on: 2026-05-25
Assigner: EEF
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| benoitc | hackney | From 2.0.0 (inc) to 4.0.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-93 | The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Improper Neutralization of CRLF Sequences, also known as CRLF Injection, in the benoitc hackney library. It occurs in the WebSocket upgrade code where user-supplied options such as host, path, headers, and protocols are copied directly into the HTTP/1.1 upgrade request without any filtering or removal of CRLF (Carriage Return Line Feed) or NUL characters. This allows an attacker who controls any of these inputs to inject arbitrary HTTP headers into the outbound WebSocket upgrade request.
Because no sanitization is performed, an attacker can exploit this to perform HTTP header injection, which can lead to credential spoofing toward upstream servers, log and cache poisoning, or request smuggling through intermediary proxies.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to inject arbitrary HTTP headers into WebSocket upgrade requests. This can lead to several security issues including:
- Credential spoofing toward upstream servers, potentially allowing attackers to impersonate legitimate users or services.
- Log and cache poisoning, which can corrupt logs or cached data, making it difficult to detect attacks or causing incorrect data to be served.
- Request smuggling via intermediary proxies, which can be used to bypass security controls or manipulate requests and responses.