CVE-2026-112880 (GCVE-0-2026-112880)
Vulnerability from cvelistv5 – Published: 2026-10-26 13:48 – Updated: 2026-10-26 15:35
VLAI
EPSS
VEX
Title
CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney
Summary
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback returns. After a 407 response from an HTTP CONNECT proxy, hackney_http_connect:handle_proxy_auth/11 calls the caller's proxy_auth_fun with the status code and the response headers and writes the returned binary into the Proxy-Authorization line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy.
The value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy's challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes.
This issue affects hackney: from 2.0.0 before 4.9.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 15:00 UTC
CWE
- CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/benoitc/hackney/releases/tag/4.9.0 | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-112880.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-112880 | related |
| https://github.com/benoitc/hackney/pull/989 | related |
| https://github.com/benoitc/hackney/commit/5df5a74… | related |
| https://github.com/benoitc/hackney/commit/5ee7d7d… | patch |
Impacted products
Date Public
2026-10-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112880",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T15:00:47.038622Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T15:35:50.632Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_http_connect"
],
"packageName": "hackney",
"packageURL": "pkg:hex/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_http_connect.erl"
],
"programRoutines": [
{
"name": "hackney_http_connect:connect/4"
},
{
"name": "hackney_http_connect:do_handshake_with_auth/9"
},
{
"name": "hackney_http_connect:handle_proxy_auth/11"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "4.9.0",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_http_connect"
],
"packageName": "benoitc/hackney",
"packageURL": "pkg:github/benoitc/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_http_connect.erl"
],
"programRoutines": [
{
"name": "hackney_http_connect:connect/4"
},
{
"name": "hackney_http_connect:do_handshake_with_auth/9"
},
{
"name": "hackney_http_connect:handle_proxy_auth/11"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "5ee7d7d19eba27e774667d472feb1e93a08af7f9",
"status": "affected",
"version": "5df5a74a2817d5b12880d217db33253ff1fae1b5",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe client connects through an HTTP CONNECT proxy with the \u003ccode\u003eproxy_auth_fun\u003c/code\u003e option set, and the callback builds its result from data an untrusted party can influence, such as the proxy\u0027s 407 challenge headers. Deployments without \u003ccode\u003eproxy_auth_fun\u003c/code\u003e, or whose callback returns a fixed credential, are not affected.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The client connects through an HTTP CONNECT proxy with the `proxy_auth_fun` option set, and the callback builds its result from data an untrusted party can influence, such as the proxy\u0027s 407 challenge headers. Deployments without `proxy_auth_fun`, or whose callback returns a fixed credential, are not affected."
}
],
"value": "The client connects through an HTTP CONNECT proxy with the proxy_auth_fun option set, and the callback builds its result from data an untrusted party can influence, such as the proxy\u0027s 407 challenge headers. Deployments without proxy_auth_fun, or whose callback returns a fixed credential, are not affected."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.0",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Coles"
},
{
"lang": "en",
"type": "reporter",
"value": "Daniel Coles"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Benoit Chesneau"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-10-26T10:18:44.000Z",
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in \u003ccode\u003ehackney_http_connect\u003c/code\u003e in benoitc hackney allows HTTP Request Splitting via the value a \u003ccode\u003eproxy_auth_fun\u003c/code\u003e callback returns. After a 407 response from an HTTP CONNECT proxy, \u003ccode\u003ehackney_http_connect:handle_proxy_auth/11\u003c/code\u003e calls the caller\u0027s \u003ccode\u003eproxy_auth_fun\u003c/code\u003e with the status code and the response headers and writes the returned binary into the \u003ccode\u003eProxy-Authorization\u003c/code\u003e line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy.\u003c/p\u003e\n\u003cp\u003eThe value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy\u0027s challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes.\u003c/p\u003e\n\u003cp\u003eThis issue affects hackney: from 2.0.0 before 4.9.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in `hackney_http_connect` in benoitc hackney allows HTTP Request Splitting via the value a `proxy_auth_fun` callback returns. After a 407 response from an HTTP CONNECT proxy, `hackney_http_connect:handle_proxy_auth/11` calls the caller\u0027s `proxy_auth_fun` with the status code and the response headers and writes the returned binary into the `Proxy-Authorization` line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy.\n\nThe value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy\u0027s challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes.\n\nThis issue affects hackney: from 2.0.0 before 4.9.0."
}
],
"value": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback returns. After a 407 response from an HTTP CONNECT proxy, hackney_http_connect:handle_proxy_auth/11 calls the caller\u0027s proxy_auth_fun with the status code and the response headers and writes the returned binary into the Proxy-Authorization line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy.\n\nThe value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy\u0027s challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes.\n\nThis issue affects hackney: from 2.0.0 before 4.9.0."
}
],
"impacts": [
{
"capecId": "CAPEC-105",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA party who controls what the application\u0027s \u003ccode\u003eproxy_auth_fun\u003c/code\u003e returns, for instance through the challenge headers of a proxy it can influence, can add header lines to the CONNECT request the client sends to its proxy.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A party who controls what the application\u0027s `proxy_auth_fun` returns, for instance through the challenge headers of a proxy it can influence, can add header lines to the CONNECT request the client sends to its proxy."
}
],
"value": "A party who controls what the application\u0027s proxy_auth_fun returns, for instance through the challenge headers of a proxy it can influence, can add header lines to the CONNECT request the client sends to its proxy."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-113",
"description": "CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:48:46.589Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "hackney 4.9.0 release notes",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/benoitc/hackney/releases/tag/4.9.0"
},
{
"name": "EEF CNA record for CVE-2026-112880",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-112880.html"
},
{
"name": "OSV record EEF-CVE-2026-112880",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-112880"
},
{
"name": "Refuse CR/LF/NUL in the proxy_auth_fun result (benoitc/hackney#989)",
"tags": [
"related"
],
"url": "https://github.com/benoitc/hackney/pull/989"
},
{
"name": "Introducing commit 5df5a74 in benoitc/hackney",
"tags": [
"related"
],
"url": "https://github.com/benoitc/hackney/commit/5df5a74a2817d5b12880d217db33253ff1fae1b5"
},
{
"name": "Fix commit 5ee7d7d in benoitc/hackney",
"tags": [
"patch"
],
"url": "https://github.com/benoitc/hackney/commit/5ee7d7d19eba27e774667d472feb1e93a08af7f9"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCheck the value your \u003ccode\u003eproxy_auth_fun\u003c/code\u003e is about to return for CR, LF and NUL bytes and return \u003ccode\u003e{error, Reason}\u003c/code\u003e instead when one is present. The callback runs in the application, so the check can be made there.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Check the value your `proxy_auth_fun` is about to return for CR, LF and NUL bytes and return `{error, Reason}` instead when one is present. The callback runs in the application, so the check can be made there."
}
],
"value": "Check the value your proxy_auth_fun is about to return for CR, LF and NUL bytes and return {error, Reason} instead when one is present. The callback runs in the application, so the check can be made there."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Challenge.\u003c/strong\u003e \u003ccode\u003ehackney_http_connect:do_handshake_with_auth/9\u003c/code\u003e in \u003ccode\u003esrc/hackney_http_connect.erl\u003c/code\u003e sends the CONNECT request to the proxy. When the proxy answers 407 and the \u003ccode\u003eproxy_auth_fun\u003c/code\u003e option is set, it hands the status code and the parsed response headers to \u003ccode\u003ehackney_http_connect:handle_proxy_auth/11\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Callback result.\u003c/strong\u003e \u003ccode\u003ehandle_proxy_auth/11\u003c/code\u003e calls the caller\u0027s \u003ccode\u003eproxy_auth_fun\u003c/code\u003e with those two values. On \u003ccode\u003e{ok, AuthHeader}\u003c/code\u003e it removes any existing \u003ccode\u003eProxy-Authorization\u003c/code\u003e header and appends the binary \u003ccode\u003e\u0026lt;\u0026lt;\"Proxy-Authorization: \", AuthHeader/binary\u0026gt;\u0026gt;\u003c/code\u003e to the header list, then retries the handshake with it.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Splitting.\u003c/strong\u003e The header list is joined with CRLF into the CONNECT request. A CR, LF or NUL byte inside \u003ccode\u003eAuthHeader\u003c/code\u003e therefore ends the \u003ccode\u003eProxy-Authorization\u003c/code\u003e line early and the rest is sent as further header lines. The target host and the request headers go through control-byte checks on this path; the callback result did not. The fix applies the same \u003ccode\u003ehas_ctl_bytes/1\u003c/code\u003e check to it and returns \u003ccode\u003e{error, {proxy_auth_error, invalid_header}}\u003c/code\u003e.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Challenge.** `hackney_http_connect:do_handshake_with_auth/9` in `src/hackney_http_connect.erl` sends the CONNECT request to the proxy. When the proxy answers 407 and the `proxy_auth_fun` option is set, it hands the status code and the parsed response headers to `hackney_http_connect:handle_proxy_auth/11`.\n\n**2. Callback result.** `handle_proxy_auth/11` calls the caller\u0027s `proxy_auth_fun` with those two values. On `{ok, AuthHeader}` it removes any existing `Proxy-Authorization` header and appends the binary `\u003c\u003c\"Proxy-Authorization: \", AuthHeader/binary\u003e\u003e` to the header list, then retries the handshake with it.\n\n**3. Splitting.** The header list is joined with CRLF into the CONNECT request. A CR, LF or NUL byte inside `AuthHeader` therefore ends the `Proxy-Authorization` line early and the rest is sent as further header lines. The target host and the request headers go through control-byte checks on this path; the callback result did not. The fix applies the same `has_ctl_bytes/1` check to it and returns `{error, {proxy_auth_error, invalid_header}}`."
}
],
"value": "1. Challenge. hackney_http_connect:do_handshake_with_auth/9 in src/hackney_http_connect.erl sends the CONNECT request to the proxy. When the proxy answers 407 and the proxy_auth_fun option is set, it hands the status code and the parsed response headers to hackney_http_connect:handle_proxy_auth/11.\n\n2. Callback result. handle_proxy_auth/11 calls the caller\u0027s proxy_auth_fun with those two values. On {ok, AuthHeader} it removes any existing Proxy-Authorization header and appends the binary \u003c\u003c\"Proxy-Authorization: \", AuthHeader/binary\u003e\u003e to the header list, then retries the handshake with it.\n\n3. Splitting. The header list is joined with CRLF into the CONNECT request. A CR, LF or NUL byte inside AuthHeader therefore ends the Proxy-Authorization line early and the rest is sent as further header lines. The target host and the request headers go through control-byte checks on this path; the callback result did not. The fix applies the same has_ctl_bytes/1 check to it and returns {error, {proxy_auth_error, invalid_header}}."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-112880",
"datePublished": "2026-10-26T13:48:46.589Z",
"dateReserved": "2026-10-26T10:15:01.166Z",
"dateUpdated": "2026-10-26T15:35:50.632Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-112880",
"date": "2026-10-27",
"epss": "0.00188",
"percentile": "0.08352"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_http_connect"
],
"packageName": "hackney",
"packageURL": "pkg:hex/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_http_connect.erl"
],
"programRoutines": [
{
"name": "hackney_http_connect:connect/4"
},
{
"name": "hackney_http_connect:do_handshake_with_auth/9"
},
{
"name": "hackney_http_connect:handle_proxy_auth/11"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "4.9.0",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_http_connect"
],
"packageName": "benoitc/hackney",
"packageURL": "pkg:github/benoitc/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_http_connect.erl"
],
"programRoutines": [
{
"name": "hackney_http_connect:connect/4"
},
{
"name": "hackney_http_connect:do_handshake_with_auth/9"
},
{
"name": "hackney_http_connect:handle_proxy_auth/11"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "5ee7d7d19eba27e774667d472feb1e93a08af7f9",
"status": "affected",
"version": "5df5a74a2817d5b12880d217db33253ff1fae1b5",
"versionType": "git"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback returns. After a 407 response from an HTTP CONNECT proxy, hackney_http_connect:handle_proxy_auth/11 calls the caller\u0027s proxy_auth_fun with the status code and the response headers and writes the returned binary into the Proxy-Authorization line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy.\n\nThe value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy\u0027s challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes.\n\nThis issue affects hackney: from 2.0.0 before 4.9.0."
}
],
"id": "CVE-2026-112880",
"lastModified": "2026-10-26T16:59:16.113",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 2.1,
"baseSeverity": "LOW",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-112880",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T15:00:47.038622Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-10-26T14:16:28.440",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://cna.erlef.org/cves/CVE-2026-112880.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/benoitc/hackney/commit/5df5a74a2817d5b12880d217db33253ff1fae1b5"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/benoitc/hackney/commit/5ee7d7d19eba27e774667d472feb1e93a08af7f9"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/benoitc/hackney/pull/989"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/benoitc/hackney/releases/tag/4.9.0"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-112880"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-113"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112880",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T15:00:47.038622Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T15:32:18.053Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_http_connect"
],
"packageName": "hackney",
"packageURL": "pkg:hex/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_http_connect.erl"
],
"programRoutines": [
{
"name": "hackney_http_connect:connect/4"
},
{
"name": "hackney_http_connect:do_handshake_with_auth/9"
},
{
"name": "hackney_http_connect:handle_proxy_auth/11"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "4.9.0",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"hackney_http_connect"
],
"packageName": "benoitc/hackney",
"packageURL": "pkg:github/benoitc/hackney",
"product": "hackney",
"programFiles": [
"src/hackney_http_connect.erl"
],
"programRoutines": [
{
"name": "hackney_http_connect:connect/4"
},
{
"name": "hackney_http_connect:do_handshake_with_auth/9"
},
{
"name": "hackney_http_connect:handle_proxy_auth/11"
}
],
"repo": "https://github.com/benoitc/hackney",
"vendor": "benoitc",
"versions": [
{
"lessThan": "5ee7d7d19eba27e774667d472feb1e93a08af7f9",
"status": "affected",
"version": "5df5a74a2817d5b12880d217db33253ff1fae1b5",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe client connects through an HTTP CONNECT proxy with the \u003ccode\u003eproxy_auth_fun\u003c/code\u003e option set, and the callback builds its result from data an untrusted party can influence, such as the proxy\u0027s 407 challenge headers. Deployments without \u003ccode\u003eproxy_auth_fun\u003c/code\u003e, or whose callback returns a fixed credential, are not affected.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The client connects through an HTTP CONNECT proxy with the `proxy_auth_fun` option set, and the callback builds its result from data an untrusted party can influence, such as the proxy\u0027s 407 challenge headers. Deployments without `proxy_auth_fun`, or whose callback returns a fixed credential, are not affected."
}
],
"value": "The client connects through an HTTP CONNECT proxy with the proxy_auth_fun option set, and the callback builds its result from data an untrusted party can influence, such as the proxy\u0027s 407 challenge headers. Deployments without proxy_auth_fun, or whose callback returns a fixed credential, are not affected."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.0",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Coles"
},
{
"lang": "en",
"type": "reporter",
"value": "Daniel Coles"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Benoit Chesneau"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-10-26T10:18:44.000Z",
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in \u003ccode\u003ehackney_http_connect\u003c/code\u003e in benoitc hackney allows HTTP Request Splitting via the value a \u003ccode\u003eproxy_auth_fun\u003c/code\u003e callback returns. After a 407 response from an HTTP CONNECT proxy, \u003ccode\u003ehackney_http_connect:handle_proxy_auth/11\u003c/code\u003e calls the caller\u0027s \u003ccode\u003eproxy_auth_fun\u003c/code\u003e with the status code and the response headers and writes the returned binary into the \u003ccode\u003eProxy-Authorization\u003c/code\u003e line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy.\u003c/p\u003e\n\u003cp\u003eThe value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy\u0027s challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes.\u003c/p\u003e\n\u003cp\u003eThis issue affects hackney: from 2.0.0 before 4.9.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in `hackney_http_connect` in benoitc hackney allows HTTP Request Splitting via the value a `proxy_auth_fun` callback returns. After a 407 response from an HTTP CONNECT proxy, `hackney_http_connect:handle_proxy_auth/11` calls the caller\u0027s `proxy_auth_fun` with the status code and the response headers and writes the returned binary into the `Proxy-Authorization` line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy.\n\nThe value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy\u0027s challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes.\n\nThis issue affects hackney: from 2.0.0 before 4.9.0."
}
],
"value": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback returns. After a 407 response from an HTTP CONNECT proxy, hackney_http_connect:handle_proxy_auth/11 calls the caller\u0027s proxy_auth_fun with the status code and the response headers and writes the returned binary into the Proxy-Authorization line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy.\n\nThe value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy\u0027s challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes.\n\nThis issue affects hackney: from 2.0.0 before 4.9.0."
}
],
"impacts": [
{
"capecId": "CAPEC-105",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA party who controls what the application\u0027s \u003ccode\u003eproxy_auth_fun\u003c/code\u003e returns, for instance through the challenge headers of a proxy it can influence, can add header lines to the CONNECT request the client sends to its proxy.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A party who controls what the application\u0027s `proxy_auth_fun` returns, for instance through the challenge headers of a proxy it can influence, can add header lines to the CONNECT request the client sends to its proxy."
}
],
"value": "A party who controls what the application\u0027s proxy_auth_fun returns, for instance through the challenge headers of a proxy it can influence, can add header lines to the CONNECT request the client sends to its proxy."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-113",
"description": "CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:48:46.589Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "hackney 4.9.0 release notes",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/benoitc/hackney/releases/tag/4.9.0"
},
{
"name": "EEF CNA record for CVE-2026-112880",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-112880.html"
},
{
"name": "OSV record EEF-CVE-2026-112880",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-112880"
},
{
"name": "Refuse CR/LF/NUL in the proxy_auth_fun result (benoitc/hackney#989)",
"tags": [
"related"
],
"url": "https://github.com/benoitc/hackney/pull/989"
},
{
"name": "Introducing commit 5df5a74 in benoitc/hackney",
"tags": [
"related"
],
"url": "https://github.com/benoitc/hackney/commit/5df5a74a2817d5b12880d217db33253ff1fae1b5"
},
{
"name": "Fix commit 5ee7d7d in benoitc/hackney",
"tags": [
"patch"
],
"url": "https://github.com/benoitc/hackney/commit/5ee7d7d19eba27e774667d472feb1e93a08af7f9"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCheck the value your \u003ccode\u003eproxy_auth_fun\u003c/code\u003e is about to return for CR, LF and NUL bytes and return \u003ccode\u003e{error, Reason}\u003c/code\u003e instead when one is present. The callback runs in the application, so the check can be made there.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Check the value your `proxy_auth_fun` is about to return for CR, LF and NUL bytes and return `{error, Reason}` instead when one is present. The callback runs in the application, so the check can be made there."
}
],
"value": "Check the value your proxy_auth_fun is about to return for CR, LF and NUL bytes and return {error, Reason} instead when one is present. The callback runs in the application, so the check can be made there."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Challenge.\u003c/strong\u003e \u003ccode\u003ehackney_http_connect:do_handshake_with_auth/9\u003c/code\u003e in \u003ccode\u003esrc/hackney_http_connect.erl\u003c/code\u003e sends the CONNECT request to the proxy. When the proxy answers 407 and the \u003ccode\u003eproxy_auth_fun\u003c/code\u003e option is set, it hands the status code and the parsed response headers to \u003ccode\u003ehackney_http_connect:handle_proxy_auth/11\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Callback result.\u003c/strong\u003e \u003ccode\u003ehandle_proxy_auth/11\u003c/code\u003e calls the caller\u0027s \u003ccode\u003eproxy_auth_fun\u003c/code\u003e with those two values. On \u003ccode\u003e{ok, AuthHeader}\u003c/code\u003e it removes any existing \u003ccode\u003eProxy-Authorization\u003c/code\u003e header and appends the binary \u003ccode\u003e\u0026lt;\u0026lt;\"Proxy-Authorization: \", AuthHeader/binary\u0026gt;\u0026gt;\u003c/code\u003e to the header list, then retries the handshake with it.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Splitting.\u003c/strong\u003e The header list is joined with CRLF into the CONNECT request. A CR, LF or NUL byte inside \u003ccode\u003eAuthHeader\u003c/code\u003e therefore ends the \u003ccode\u003eProxy-Authorization\u003c/code\u003e line early and the rest is sent as further header lines. The target host and the request headers go through control-byte checks on this path; the callback result did not. The fix applies the same \u003ccode\u003ehas_ctl_bytes/1\u003c/code\u003e check to it and returns \u003ccode\u003e{error, {proxy_auth_error, invalid_header}}\u003c/code\u003e.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Challenge.** `hackney_http_connect:do_handshake_with_auth/9` in `src/hackney_http_connect.erl` sends the CONNECT request to the proxy. When the proxy answers 407 and the `proxy_auth_fun` option is set, it hands the status code and the parsed response headers to `hackney_http_connect:handle_proxy_auth/11`.\n\n**2. Callback result.** `handle_proxy_auth/11` calls the caller\u0027s `proxy_auth_fun` with those two values. On `{ok, AuthHeader}` it removes any existing `Proxy-Authorization` header and appends the binary `\u003c\u003c\"Proxy-Authorization: \", AuthHeader/binary\u003e\u003e` to the header list, then retries the handshake with it.\n\n**3. Splitting.** The header list is joined with CRLF into the CONNECT request. A CR, LF or NUL byte inside `AuthHeader` therefore ends the `Proxy-Authorization` line early and the rest is sent as further header lines. The target host and the request headers go through control-byte checks on this path; the callback result did not. The fix applies the same `has_ctl_bytes/1` check to it and returns `{error, {proxy_auth_error, invalid_header}}`."
}
],
"value": "1. Challenge. hackney_http_connect:do_handshake_with_auth/9 in src/hackney_http_connect.erl sends the CONNECT request to the proxy. When the proxy answers 407 and the proxy_auth_fun option is set, it hands the status code and the parsed response headers to hackney_http_connect:handle_proxy_auth/11.\n\n2. Callback result. handle_proxy_auth/11 calls the caller\u0027s proxy_auth_fun with those two values. On {ok, AuthHeader} it removes any existing Proxy-Authorization header and appends the binary \u003c\u003c\"Proxy-Authorization: \", AuthHeader/binary\u003e\u003e to the header list, then retries the handshake with it.\n\n3. Splitting. The header list is joined with CRLF into the CONNECT request. A CR, LF or NUL byte inside AuthHeader therefore ends the Proxy-Authorization line early and the rest is sent as further header lines. The target host and the request headers go through control-byte checks on this path; the callback result did not. The fix applies the same has_ctl_bytes/1 check to it and returns {error, {proxy_auth_error, invalid_header}}."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-112880",
"datePublished": "2026-10-26T13:48:46.589Z",
"dateReserved": "2026-10-26T10:15:01.166Z",
"dateUpdated": "2026-10-26T15:35:50.632Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.