CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney
Impact
Hackney versions 2.0.0 before 4.9.0 have a CRLF injection vulnerability in the Proxy-Authorization header, allowing HTTP Request Splitting via the proxy_auth_fun callback return value. An attacker-influenced value with CR, LF, or NUL bytes can add header lines to the request sent to the proxy. The issue occurs when the callback derives the value from untrusted data.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.What to do
Check the value your proxy_auth_fun is about to return for CR, LF and NUL bytes and return {error, Reason} instead when one is present. The callback runs in the application, so the check can be made there.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
benoitc · EEF
hackney
1 range
benoitc · EEF
hackney
Package identity
pkg:hex/hackneyExplore hackney →Identity supplied by EEF. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
2.0.0 → before 4.9.0
semver versions
Other versions: unaffected
Product identifiers (CPE)
cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*benoitc · EEF
hackney
1 range
benoitc · EEF
hackney
Package identity
pkg:github/benoitc/hackneyIdentity supplied by EEF. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
5df5a74a2817d5b12880d217db33253ff1fae1b5 → before 5ee7d7d19eba27e774667d472feb1e93a08af7f9
git versions
Other versions: unaffected
Product identifiers (CPE)
cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*Original source description
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback returns. After a 407 response from an HTTP CONNECT proxy, hackney_http_connect:handle_proxy_auth/11 calls the caller's proxy_auth_fun with the status code and the response headers and writes the returned binary into the Proxy-Authorization line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy.
The value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy's challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes.
This issue affects hackney: from 2.0.0 before 4.9.0.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-112880View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
EEF · platform conditions
All conditions must hold
Any condition may hold
Vulnerable product
cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*From (inclusive): 2.0.0
Before: 4.9.0
Original applicability statements
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.0",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
]Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.