CVE-2026-47069

medium

Published 2026-05-25 · Modified 2026-05-27

CVSS v3

5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVSS v2

—

VIR risk

5.3

Description

CRLF injection in cookie domain/path options in hackney

Exploit likelihood

63%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

vendor Authored 2026-05-27

Vendor advisory: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db — https://osv.dev/vulnerability/EEF-CVE-2026-47069

vendor Authored 2026-05-27

Vendor advisory: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db — https://github.com/benoitc/hackney/security/advisories/GHSA-mp55-p8c9-rfw2

vendor Authored 2026-05-27

Vendor advisory: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db — https://github.com/benoitc/hackney/commit/8e02b99c28aea1b3fa2ddc0e66f51fe5bb0ac540

vendor Authored 2026-05-27

Vendor advisory: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db — https://cna.erlef.org/cves/CVE-2026-47069.html

Ecosystem	Package	Vulnerable	Fixed
Hex	hackney	`>=0.9.0,<4.0.1`	`4.0.1`

Vendor	Product	Versions	Fixed
benoitc	hackney	`{"startIncluding":"0.9.0","endExcluding":"4.0.1"}`	`4.0.1`

CWE-93

Verify integrity in audit chain (admin only). AS-IS.