Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
💧 Hex
Not in CISA KEV

Hackney has CRLF / header injection via unvalidated `domain` and `path` optionsGHSA-mp55-p8c9-rfw2

Fix: benoitc/hackney@8e02b99

GHSA-mp55-p8c9-rfw2 is a CWE-93 vulnerability in hackney. A fix is available for hackney — see the affected versions and patch details below.

Also known asCVE-2026-47069EEF-CVE-2026-47069
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 24, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.

Exploitation and automatability from CISA’s SSVC triage for GHSA-mp55-p8c9-rfw2.

EPSS Exploitation Probability

via FIRST.org ↗
0.4%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs29th percentile — riskier than 29% of all scored CVEsHighest risk
0.00%0.31%0.62%0.93%0.0%0.4%Jun 26Sep 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

1 pkg affected
💧hackney

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Hex packages — download data is not available via public APIs for these ecosystems.

Description

Summary

CRLF injection in hackney_cookie:setcookie/3 (src/hackney_cookie.erl). The function validates Name and Value against CR/LF and control characters but concatenates the domain and path options verbatim into the output binary. If either option carries attacker-controlled data, a Host header forwarded as the cookie domain, a request URI forwarded as the cookie path, a \r\n in the value splits the Set-Cookie header and lets the attacker inject additional headers into the HTTP response.

Details

1. Asymmetric validation

Lines 27–34 of hackney_cookie.erl run binary:match on Name and Value, rejecting =, ,, ;, whitespace, \r, \n, \013, and \014. The Domain and Path options (lines 47 and 51) skip this check entirely and land straight in the result iolist:

[<<"; Domain=">>, Domain]
[<<"; Path=">>,   Path]

iolist_to_binary(...) on line 63 flattens everything and returns it to the caller.

2. Injection

A Path of <<"/x\r\nSet-Cookie: admin=1; Path=/">> produces a binary with a literal \r\n. Written into a Set-Cookie response header, the receiving HTTP parser splits it into two headers — one legitimate, one attacker-controlled.

3. Realistic trigger

Common patterns: keying the cookie domain off Host, deriving the path from the request URI, or copying a Location path into a cookie. Any of these lets a remote attacker control the injected content.

PoC

  1. Call hackney_cookie:setcookie(<<"sid">>, <<"abc">>, [{path, <<"/x\r\nSet-Cookie: admin=1; Path=/">>}]).
  2. The returned binary contains a literal \r\n followed by a second Set-Cookie: line.
  3. Write the result into a Set-Cookie response header — the client parses two headers, including admin=1.

Impact

Cookie injection / HTTP response splitting at the hackney_cookie API boundary. Affects hackney 0.9.0 through 4.0.0 wherever domain or path options are populated from request data. Exploitation can overwrite session/auth cookies, fix cookies, or strip Secure/HttpOnly flags. CVSS v4.0: 2.1 (LOW) — requires attacker-controlled input to reach the domain or path option.

Resources

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
💧Hexhackney≥ 0.9.0&&< 4.0.14.0.1mix deps.update hackney

Affected Products

1 product · 1 configurations
Application
hackneybenoitc
≥ 0.9.0 && < 4.0.1
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for hackney, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update hackney to 4.0.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-mp55-p8c9-rfw2 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Summary CRLF injection in `hackney_cookie:setcookie/3` (`src/hackney_cookie.erl`). The function validates `Name` and `Value` against CR/LF and control characters but concatenates the `domain` and `path` options verbatim into the output binary. If either option carries attacker-controlled data, a `Host` header forwarded as the cookie domain, a request URI forwarded as the cookie path, a `\r\n` in the value splits the `Set-Cookie` header and lets the attacker inject additional headers into the HTTP response. ### Details **1. Asymmetric validation** Lines 27–34 of `hackney_cookie.erl` run
O3 Security · Impact-Aware SCA

Is GHSA-mp55-p8c9-rfw2 in your dependencies?

Find it across Hex, including transitive dependencies.

Scan my dependencies How O3 SCA works
Hackney has CRLF / header injection via unvalidated…