Live › vulnerability › CVE-2026-112880
Go to dashboardErlang's hackney HTTP client writes whatever a proxy_auth_fun callback returns into a Proxy-Authorization header without stripping CR, LF or NUL bytes. If that value comes from untrusted data such as a proxy's challenge headers, an attacker can inject extra header lines into the CONNECT retry request sent to the proxy.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Only Erlang or Elixir applications that use hackney with HTTP CONNECT proxies and a proxy_auth_fun callback that derives its return value from untrusted input, such as the proxy's challenge headers. Applications that use hackney without proxies, or whose proxy_auth_fun returns fixed credentials, are not exposed.
No product ranges from the sources yet.
rebar3 deps or check rebar.lock for hackney at a version from 2.0.0 up to but not including 4.9.0proxy_auth_fun and check whether its return value is built from data a remote party can influence4.9.0 or laterproxy_auth_fun returns only values built from trusted credentials and never from proxy response headersEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback returns. After a 407 response from an HTTP CONNECT proxy, hackney_http_connect:handle_proxy_auth/11 calls the caller's proxy_auth_fun with the status code and the response headers and writes the returned binary into the Proxy-Authorization line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy.
The value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy's challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes.
This issue affects hackney: from 2.0.0 before 4.9.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-112880")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.