Executive brief
Hackney, a popular HTTP client library for Erlang, is vulnerable to a header injection flaw. This occurs when the library processes cookie settings using untrusted data, allowing an attacker to inject malicious headers into an HTTP response. This could lead to session hijacking, cookie overwriting, or the removal of security flags like Secure and HttpOnly.
Technical details
A CRLF injection vulnerability exists in `hackney_cookie:setcookie/3` within `src/hackney_cookie.erl`. While the function validates the cookie 'Name' and 'Value', it fails to sanitize the 'domain' and 'path' options, concatenating them verbatim into the output binary. An attacker can provide a payload containing carriage return and line feed characters (e.g., `\r\n`) through these options if they are derived from untrusted sources like the Host header or request URI. This allows for HTTP response splitting and the injection of arbitrary headers. The issue is fixed in version 4.0.1.
Affected products
- benoitc hackney >= 0.9.0, < 4.0.1
Timeline
- 2026-05-25: disclosed
- 2026-06-26: advisory: GitHub Advisory published
- 2026-06-26: patched