The hackney_cookie:setcookie/3 function in benoitc hackney improperly neutralizes CRLF sequences in the domain and path options of cookies. While it validates the Name and Value arguments, it concatenates domain and path options verbatim into the HTTP response without validation. An attacker who can control the Host header or request path that is forwarded as the cookie domain or path can inject CRLF sequences, enabling HTTP response splitting and injection of arbitrary Set-Cookie headers. This affects hackney versions from 0.9.0 before 4.0.1.

An attacker able to supply the domain or path options for cookies can inject CRLF sequences into HTTP responses, potentially causing HTTP response splitting. This may allow injection of arbitrary Set-Cookie headers, which could lead to session fixation or other HTTP header injection issues. The overall severity is low, and no known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted input for cookie domain and path options in hackney. Validate or sanitize these inputs before passing them to the setcookie/3 function to prevent CRLF injection.