CVE-2026-47075 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-47075MEDIUM

benoitc hackney — CR/LF injection in query parameter in hackney

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   P   N   A   N   H   N    6.8   .0048   39.5     —

AFFECTED
  Product  Versions                                    Fixed
  hackney  0.13.1 –                                    —
  hackney  8bb1a359a81ae58567c84f8d24564e9742e6f2bd –  —

TIMELINE
  May 18  Reserved by EEF
  May 25  EXPLOIT PUBLISHED — CVE-2026-47075 (benoitc hackney). Public exploit reference added.
  May 25  Published (CNA: EEF)
  Jul 24  EXPLOIT PUBLISHED — CVE-2026-47075 (benoitc hackney). Public exploit reference added.

CWE-93 · CNA: EEF · CVSS v4.0 · 4 references · NVD status: Modified

Description

Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r) or line feed (\n) characters in the URL query component before constructing the HTTP/1.1 request target. Characters outside the grammar defined in RFC 3986 Section 3.4 must be percent-encoded, but hackney_url:make_url/3 passes the query binary directly without validation or escaping. An attacker who can control all or part of a URL passed to hackney can inject raw CRLF sequences into the query string, which are then sent as HTTP line breaks in the request target. This enables injection of arbitrary HTTP headers or splitting of the HTTP request. This issue affects hackney: from 0.13.1 before 4.0.1.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
May 18, 2026	Reserved	Reserved by EEF
May 25, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-47075 (benoitc hackney). Public exploit reference added.
May 25, 2026	Published	Published (CNA: EEF)
July 24, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-47075 (benoitc hackney). Public exploit reference added.

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
benoitc	hackney	—	0.13.1	—
benoitc	hackney	—	8bb1a359a81ae58567c84f8d24564e9742e6f2bd	—

Weaknesses

CWE-93

References (4)

https://cna.erlef.org/cves/CVE-2026-47075.html [Patch, Third Party Advisory]
https://github.com/benoitc/hackney/commit/ca73dd0aba0ed557449c18288bf07241671a43c9 [Patch]
https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf [Exploit, Patch, Vendor Advisory]
https://osv.dev/vulnerability/EEF-CVE-2026-47075 [Patch, Third Party Advisory]

Authoritative record: CVE-2026-47075 at cve.org

Vendors: benoitc

Weaknesses: CWE-93

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-47075 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.