# CVE-2026-47069: benoitc hackney CRLF injection in hackney_cookie

Source: https://junglewise.ai/threats/cve-2026-47069-benoitc-hackney-crlf-injection-in-hackney-cookie  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-25. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-47069 · Severity: low · CVSS 2.1 · Published 2026-05-25

Hackney, a popular HTTP client library for Erlang, is vulnerable to a header injection flaw. This occurs when the library processes cookie settings using untrusted data, allowing an attacker to inject malicious headers into an HTTP response. This could lead to session hijacking, cookie overwriting, or the removal of security flags like Secure and HttpOnly.

Technologies: [Benoit Chesneau Hackney](https://junglewise.ai/threats/technologies/hackney). Vendors: [Benoit Chesneau](https://junglewise.ai/threats/vendors/benoit-chesneau).

## Quick answers

**Is CVE-2026-47069 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47069 being exploited in the wild.

**How severe is CVE-2026-47069?** Low severity, with a CVSS score of 2.1, published 25 May 2026.

**Which products and versions are affected?** Benoit Chesneau Hackney >= 0.9.0, < 4.0.1.

**Is there a fix for CVE-2026-47069?** A patch was published on 2026-06-26. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47069 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-47069?** Check whether you run Benoit Chesneau Hackney at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A CRLF injection vulnerability exists in `hackney_cookie:setcookie/3` within `src/hackney_cookie.erl`. While the function validates the cookie 'Name' and 'Value', it fails to sanitize the 'domain' and 'path' options, concatenating them verbatim into the output binary. An attacker can provide a payload containing carriage return and line feed characters (e.g., `\r\n`) through these options if they are derived from untrusted sources like the Host header or request URI. This allows for HTTP response splitting and the injection of arbitrary headers. The issue is fixed in version 4.0.1.

## Affected products

- benoitc hackney >= 0.9.0, < 4.0.1

## Identifiers

- CVE-2026-47069
- GHSA-mp55-p8c9-rfw2

## Timeline

- 2026-05-25: disclosed
- 2026-06-26: advisory: GitHub Advisory published
- 2026-06-26: patched

## References

- [https://api.github.com/users/PJUllrich](https://api.github.com/users/PJUllrich)
- [https://github.com/PJUllrich](https://github.com/PJUllrich)
- [https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D](https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D)
- [https://api.github.com/users/PJUllrich/repos](https://api.github.com/users/PJUllrich/repos)
- [https://avatars.githubusercontent.com/u/10426523?v=4](https://avatars.githubusercontent.com/u/10426523?v=4)
- [https://api.github.com/users/PJUllrich/events%7B/privacy%7D](https://api.github.com/users/PJUllrich/events%7B/privacy%7D)

## Related threats

- [ex-aws ex_aws_sns signature bypass in verify_message/1](https://junglewise.ai/threats/cve-2026-47074-ex-aws-ex-aws-sns-signature-bypass-in-verify-message-1)
- [benoitc hackney resource exhaustion in HTTP/3 response loop](https://junglewise.ai/threats/cve-2026-47077-benoitc-hackney-resource-exhaustion-in-http-3-response-loop)
- [benoitc hackney SSRF via percent-encoded host in normalize/2](https://junglewise.ai/threats/cve-2026-47076-benoitc-hackney-ssrf-via-percent-encoded-host-in-normalize-2)
- [benoitc hackney unbounded memory consumption in WebSocket client](https://junglewise.ai/threats/cve-2026-47073-benoitc-hackney-unbounded-memory-consumption-in-websocket-client)
- [Benoitc hackney CRLF injection in WebSocket upgrade request](https://junglewise.ai/threats/cve-2026-47072-benoitc-hackney-crlf-injection-in-websocket-upgrade-request)