{"id":"CVE-2026-112880","aliases":[],"cve":{"records":[{"id":"CVE-2026-112880","source":"EEF","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-26T10:15:01.166Z","published":"2026-10-26T13:48:46.589Z","modified":"2026-10-26T15:35:50.632Z"}],"publishers":[{"name":"EEF","role":"CNA","organizationId":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","modified":"2026-10-26T13:48:46.589Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-26T15:35:50.632Z"}],"references":[{"url":"https://github.com/benoitc/hackney/releases/tag/4.9.0","tags":["vendor-advisory","related"],"source":"EEF"},{"url":"https://cna.erlef.org/cves/CVE-2026-112880.html","tags":["related"],"source":"EEF"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-112880","tags":["related"],"source":"EEF"},{"url":"https://github.com/benoitc/hackney/pull/989","tags":["related"],"source":"EEF"},{"url":"https://github.com/benoitc/hackney/commit/5df5a74a2817d5b12880d217db33253ff1fae1b5","tags":["related"],"source":"EEF"},{"url":"https://github.com/benoitc/hackney/commit/5ee7d7d19eba27e774667d472feb1e93a08af7f9","tags":["patch"],"source":"EEF"}],"weaknesses":[{"id":"CWE-113","description":"CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')","source":"EEF"}],"applicability":[{"source":"EEF","statements":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*","versionEndExcluding":"4.9.0","versionStartIncluding":"2.0.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"AND"}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-26T15:00:47.038622Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney","titleSource":"EEF","descriptionSource":"EEF","description":"Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback returns. After a 407 response from an HTTP CONNECT proxy, hackney_http_connect:handle_proxy_auth/11 calls the caller's proxy_auth_fun with the status code and the response headers and writes the returned binary into the Proxy-Authorization line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy.\n\nThe value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy's challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes.\n\nThis issue affects hackney: from 2.0.0 before 4.9.0.","score":2.1,"severity":"low","published":"2026-10-26T13:48:46.589Z","modified":"2026-10-26T15:35:50.632Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"benoitc","name":"hackney","platforms":[],"versions":[{"version":"2.0.0","status":"affected","lessThan":"4.9.0","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:hex/hackney","packageIdentity":{"ecosystem":"Hex","name":"hackney"},"cpes":["cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"],"source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-112880"},{"vendor":"benoitc","name":"hackney","platforms":[],"versions":[{"version":"5df5a74a2817d5b12880d217db33253ff1fae1b5","status":"affected","lessThan":"5ee7d7d19eba27e774667d472feb1e93a08af7f9","versionType":"git"}],"defaultStatus":"unaffected","packageURL":"pkg:github/benoitc/hackney","cpes":["cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"],"source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-112880"}],"remediation":[{"text":"Check the value your proxy_auth_fun is about to return for CR, LF and NUL bytes and return {error, Reason} instead when one is present. The callback runs in the application, so the check can be made there.","source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-112880"}],"references":["https://github.com/benoitc/hackney/releases/tag/4.9.0","https://cna.erlef.org/cves/CVE-2026-112880.html","https://osv.dev/vulnerability/EEF-CVE-2026-112880","https://github.com/benoitc/hackney/pull/989","https://github.com/benoitc/hackney/commit/5df5a74a2817d5b12880d217db33253ff1fae1b5","https://github.com/benoitc/hackney/commit/5ee7d7d19eba27e774667d472feb1e93a08af7f9"],"sources":[{"name":"CVE","id":"CVE-2026-112880","modified":"2026-10-26T15:35:50.632Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-112880"}],"assessments":[{"source":"EEF","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","score":2.1}],"sourceAffected":[],"observedAt":"2026-10-29T14:32:30.386Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T16:05:33.966Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Hackney versions 2.0.0 before 4.9.0 have a CRLF injection vulnerability in the Proxy-Authorization header, allowing HTTP Request Splitting via the proxy_auth_fun callback return value. An attacker-influenced value with CR, LF, or NUL bytes can add header lines to the request sent to the proxy. The issue occurs when the callback derives the value from untrusted data.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:37:46.353Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-112880"}]}}