The vulnerability in benoitc hackney's hackney_cookie:setcookie/3 function involves improper neutralization of CRLF sequences in the domain and path options of cookies. While the function validates the Name and Value arguments against CRLF and control characters, it concatenates the domain and path options without validation, enabling an attacker who can control these options (e.g., via Host header or request path) to inject CRLF sequences and arbitrary additional Set-Cookie headers, resulting in HTTP response splitting. This affects hackney versions from 0.9.0 before 4.0.1.

An attacker able to supply the domain or path options for cookies can inject CRLF sequences into HTTP responses, leading to HTTP response splitting. This may allow manipulation of HTTP headers and potentially affect client-side behavior. The CVSS score of 2.1 reflects a low severity impact with limited attack vector and complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid forwarding untrusted input such as Host headers or request paths directly into cookie domain or path options. Implement input validation or sanitization on these values before use in hackney_cookie:setcookie/3.