Executive brief
Hackney, a popular Erlang HTTP client, is vulnerable to a security flaw when initiating WebSocket connections. An attacker can inject malicious commands or headers into the connection request if the application uses untrusted data for connection settings. This could allow an attacker to bypass authentication, poison logs, or manipulate web traffic through intermediary servers.
Technical details
A CRLF injection vulnerability exists in hackney's WebSocket upgrade request builder (src/hackney_ws.erl). The functions init/1 and do_handshake/1 fail to sanitize the host, path, headers, and protocols options, instead splicing them directly into the raw HTTP/1.1 upgrade request via binary concatenation. Because the library does not strip carriage return (\r), line feed (\n), or null (\0) characters, an attacker can inject arbitrary header lines or rewrite the request line. This can be exploited to forge authentication headers, perform log/cache poisoning, or execute request smuggling through proxies. The issue is fixed in version 4.0.1.
Affected products
- benoitc hackney >= 2.0.0, < 4.0.1
Timeline
- 2026-05-25: disclosed
- 2026-06-26: advisory: GitHub Advisory published
- 2026-06-26: patched: Version 4.0.1 released