{"schema":"threatline.record/2","record":{"id":"CVE-2026-112880","aliases":[],"summary":"CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney","details":"Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback returns. After a 407 response from an HTTP CONNECT proxy, hackney_http_connect:handle_proxy_auth/11 calls the caller's proxy_auth_fun with the status code and the response headers and writes the returned binary into the Proxy-Authorization line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy.\n\nThe value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy's challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes.\n\nThis issue affects hackney: from 2.0.0 before 4.9.0.","categories":["Unclassified"],"product":"hackney","vendor":"benoitc","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-112880","source_modified_at":"2026-10-26T15:35:50.632Z","fetched_at":"2026-10-26T19:10:57.178988Z","product":"hackney","vendor":"benoitc","versions":[{"lessThan":"4.9.0","status":"affected","version":"2.0.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-112880","source_modified_at":"2026-10-26T15:35:50.632Z","fetched_at":"2026-10-26T19:10:57.178988Z","product":"hackney","vendor":"benoitc","versions":[{"lessThan":"5ee7d7d19eba27e774667d472feb1e93a08af7f9","status":"affected","version":"5df5a74a2817d5b12880d217db33253ff1fae1b5","versionType":"git"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-112880","source_modified_at":"2026-10-26T15:35:50.632Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"name":"hackney","ecosystem":null},"version":"4.9.0","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-112880","source_modified_at":"2026-10-26T15:35:50.632Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"name":"hackney","ecosystem":null},"version":"5ee7d7d19eba27e774667d472feb1e93a08af7f9","basis":"first unaffected version stated in the CVE record"}],"cvss":2.1,"severity":"Low","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-26T13:48:46.589Z","modified_at":"2026-10-26T15:35:50.632Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-112880","fetched_at":"2026-10-26T19:10:57.178988Z","source_modified_at":"2026-10-26T15:35:50.632Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/benoitc/hackney/releases/tag/4.9.0","tags":["vendor-advisory","related"]},{"source":"CVE List","url":"https://cna.erlef.org/cves/CVE-2026-112880.html","tags":["related"]},{"source":"CVE List","url":"https://osv.dev/vulnerability/EEF-CVE-2026-112880","tags":["related"]},{"source":"CVE List","url":"https://github.com/benoitc/hackney/pull/989","tags":["related"]},{"source":"CVE List","url":"https://github.com/benoitc/hackney/commit/5df5a74a2817d5b12880d217db33253ff1fae1b5","tags":["related"]},{"source":"CVE List","url":"https://github.com/benoitc/hackney/commit/5ee7d7d19eba27e774667d472feb1e93a08af7f9","tags":["patch"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-26T15:00:47.038622Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-26T15:35:50.632Z","content_hash":"f233572e25e07f5c9c227f3970c1dae177054f08d7c7847759ef2c02e6ca109d"}}