Is CVE-2026-47069 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47069 being exploited in the wild.

How severe is CVE-2026-47069?

Low severity, with a CVSS score of 2.1, published 25 May 2026.

Which products and versions are affected?

Benoit Chesneau Hackney >= 0.9.0, < 4.0.1.

Is there a fix for CVE-2026-47069?

A patch was published on 2026-06-26. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47069 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-47069?

Check whether you run Benoit Chesneau Hackney at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47069: benoitc hackney CRLF injection in hackney_cookie

Q: Is there a fix for CVE-2026-47069?

A patch was published on 2026-06-26. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47069 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-47069?

Check whether you run Benoit Chesneau Hackney at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47069 · Severity: low · CVSS 2.1 · Published 2026-05-25

Hackney, a popular HTTP client library for Erlang, is vulnerable to a header injection flaw. This occurs when the library processes cookie settings using untrusted data, allowing an attacker to inject malicious headers into an HTTP response. This could lead to session hijacking, cookie overwriting, or the removal of security flags like Secure and HttpOnly.

Technologies: Benoit Chesneau Hackney. Vendors: Benoit Chesneau.

Quick answers

Is CVE-2026-47069 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47069 being exploited in the wild.
How severe is CVE-2026-47069?: Low severity, with a CVSS score of 2.1, published 25 May 2026.
Which products and versions are affected?: Benoit Chesneau Hackney >= 0.9.0, < 4.0.1.
Is there a fix for CVE-2026-47069?: A patch was published on 2026-06-26. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47069 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-47069?: Check whether you run Benoit Chesneau Hackney at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A CRLF injection vulnerability exists in `hackney_cookie:setcookie/3` within `src/hackney_cookie.erl`. While the function validates the cookie 'Name' and 'Value', it fails to sanitize the 'domain' and 'path' options, concatenating them verbatim into the output binary. An attacker can provide a payload containing carriage return and line feed characters (e.g., `\r\n`) through these options if they are derived from untrusted sources like the Host header or request URI. This allows for HTTP response splitting and the injection of arbitrary headers. The issue is fixed in version 4.0.1.

Affected products

benoitc hackney >= 0.9.0, < 4.0.1

Identifiers

CVE-2026-47069
GHSA-mp55-p8c9-rfw2

Timeline

2026-05-25: disclosed
2026-06-26: advisory: GitHub Advisory published
2026-06-26: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.