{"items":[{"id":"NVI-00017659","kind":"vulnerability","title":"Hackney has CR/LF injection in query parameter","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-j9wq-vxxc-94wf","CVE-2026-47075"],"plain_summary":"GitHub lists this reviewed advisory for hackney. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-3d8bf7b0a760b7c722750d2300013e73"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-3d8bf7b0a760b7c722750d2300013e73","url":"https://github.com/advisories/GHSA-j9wq-vxxc-94wf","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-j9wq-vxxc-94wf","publisher":"GitHub Advisory Database","observed_at":"2026-11-05T19:05:04.022Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-3d8bf7b0a760b7c722750d2300013e73"],"technology":"hackney","known_exclusions":[],"conditions_summary":"### Summary\n\n`hackney_url:make_url/3` passes the URL query component directly into the HTTP/1.1 request target without percent-encoding `\\r` or `\\n`. RFC 3986 §3.4 requires characters outside the query grammar to be percent-encoded, but no validation or escaping occurs. An attacker who controls any portion of the URL passed to hackney can inject raw CRLF sequences into the request line, enabling HTTP header injection or full request splitting.\n\n### Details\n\n`hackney_url:make_url/3` in `src/hackney_url.erl` builds the request target by concatenating the path and query binaries. The query string is used as-is — no character-class check, no percent-encoding of `\\r` or `\\n`. When hackney serializes the request, the query value lands verbatim in the `GET ? HTTP/1.1\\r\\n` request line. A query value containing `\\r\\n` terminates the request line early; subsequent bytes are parsed by the server (or any intermediary proxy) as additional header lines or a second request.\n\nA concrete example: a URL with query `?q=x HTTP/1.1\\r\\nX-Injected: yes\\r\\nX:` produces the following on the wire:\n\n```\nGET /?q=x HTTP/1.1\nX-Injected: yes\nX: HTTP/1.1\nHost: ...\n```\n\nThe server sees `X-Injected: y","public_affected_ranges":["< 4.0.1"]}],"null_published_at":"2026-11-05T19:10:21.447Z","source_updated_at":"2026-06-26T21:59:01.000Z","source_disclosed_at":"2026-06-26T21:58:59.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-05T19:05:04.022Z"}],"next_cursor":null,"snapshot_revision":"42594"}