CVE-2026-112880

Name of the Vulnerable Software and Affected Versions hackney versions 2.0.0 through 4.8.9

Description An HTTP Request Splitting issue exists in hackney http connect due to improper neutralization of CRLF sequences in HTTP headers. When an HTTP CONNECT proxy returns a 407 response, the function hackney http connect:handle proxy auth/11 executes a proxy auth fun callback and writes the returned binary directly into the Proxy-Authorization line of the retry request without validation. If the returned value contains a Carriage Return (CR), Line Feed (LF), or NUL byte, an attacker can inject additional header lines into the request sent to the proxy. This occurs when the callback derives its value from untrusted data, such as the proxy's challenge headers.

Recommendations Update to version 4.9.0 or later. As a temporary workaround, implement a check within the proxy auth fun callback to ensure the returned value does not contain CR, LF, or NUL bytes, returning {error, Reason} if any are detected.