{"id":"CVE-2026-47072","aliases":["EEF-CVE-2026-47072","GHSA-f9vr-g2g2-x9fg"],"url":"https://o3.security/vulnerability/CVE-2026-47072","summary":"CRLF injection in WebSocket upgrade request in hackney","details":"### Summary\n\nCRLF injection in hackney's WebSocket upgrade request builder (`src/hackney_ws.erl`). `init/1` copies the `host`, `path`, `headers`, and `protocols` options from the caller-supplied opts map verbatim into `#ws_data{}`, and `do_handshake/1` splices them directly into the raw HTTP/1.1 upgrade request by binary concatenation with no `\\r\\n` or `\\0` stripping. A caller that passes any of these fields from untrusted input can inject arbitrary header lines into the outbound upgrade request.\n\n### Details\n\n`do_handshake/1` builds the upgrade request at several concatenation sites:\n\n- **Host header** (lines 583–590): the host binary is written straight into `Host: <host>:<port>\\r\\n`.\n- **Sec-WebSocket-Protocol** (lines 601–602): protocol tokens are joined with `, ` and appended as a header line.\n- **Extra headers** (line 606): caller-supplied `{Name, Value}` tuples are concatenated as `Name: Value\\r\\n` with no sanitization of either component.\n- **Request path** (line 611): the path is interpolated into the `GET <path> HTTP/1.1\\r\\n` request line.\n\nNone of these sites reject `\\r`, `\\n`, or `\\0`. A header value like `<<\"benign\\r\\nAuthorization: Bearer token\">>` produces two distinct header lines on the wire. A path with an embedded `\\r\\n` rewrites the request line itself.\n\n### PoC\n\n1. Call `:hackney_ws.start_link/1` with `headers: [{\"X-User\", \"v\\r\\nAuthorization: Bearer attacker\"}]`.\n2. Connect to a raw TCP listener and capture the bytes hackney writes.\n3. The request contains a standalone `Authorization: Bearer attacker` line that the upstream WebSocket server parses as a legitimate header.\n\n### Impact\n\nHeader injection / request smuggling in outbound WebSocket upgrades. Affects hackney 2.0.0 through 4.0.0 wherever `host`, `path`, `headers`, or `protocols` options are populated from network or user input. Consequences include forging authentication headers toward the upstream server, log and cache poisoning, and request smuggling through intermediary proxies. CVSS v4.0: **6.9 (MEDIUM)**.\n\n## Resources\n\n* Introduction commit: https://github.com/benoitc/hackney/commit/690cecaf236fba49526da404a5bc889a24367a3e\n* Patch commit: https://github.com/benoitc/hackney/commit/52310ca807e7b48441ba0e9129171f535313fdd1","published":"2026-05-25T14:00:47.852Z","modified":"2026-10-21T02:30:16.569459729Z","cvss":null,"epss":{"score":0.00542,"percentile":0.44196,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Hex","name":"hackney","fixedVersion":"4.0.1"}],"fix":{"url":"https://github.com/benoitc/hackney/commit/52310ca807e7b48441ba0e9129171f535313fdd1","label":"benoitc/hackney@52310ca"},"references":[{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-47072.html"},{"type":"WEB","url":"https://github.com"},{"type":"WEB","url":"https://osv.dev/vulnerability/EEF-CVE-2026-47072"},{"type":"WEB","url":"https://repo.hex.pm"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47072.json"},{"type":"ADVISORY","url":"https://github.com/benoitc/hackney/security/advisories/GHSA-f9vr-g2g2-x9fg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47072"},{"type":"FIX","url":"https://github.com/benoitc/hackney/commit/52310ca807e7b48441ba0e9129171f535313fdd1"},{"type":"PACKAGE","url":"https://github.com/benoitc/hackney"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:30:16.569459729Z"}}