The vulnerability in benoitc hackney (versions 2.0.0 to before 4.0.1) is due to improper neutralization of CRLF sequences in the WebSocket upgrade request construction. Specifically, the code copies caller-supplied options (host, path, headers, protocols) into an internal record and concatenates them verbatim into the raw HTTP/1.1 upgrade request without stripping CRLF or NUL characters. This lack of sanitization enables an attacker controlling these inputs to inject arbitrary HTTP headers, which can be exploited for HTTP request/response splitting attacks such as header injection, credential spoofing, log and cache poisoning, or request smuggling through intermediary proxies.

An attacker who can influence the host, path, headers, or protocol options passed to hackney_ws:start_link/1 can inject arbitrary HTTP headers into outbound WebSocket upgrade requests. This can lead to multiple impacts including header injection, credential spoofing toward upstream servers, log and cache poisoning, and request smuggling attacks. These impacts can undermine the integrity and security of communications and potentially facilitate further attacks on backend systems or intermediaries.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should avoid passing untrusted input directly into the affected options of hackney_ws:start_link/1. Input validation or sanitization to remove CRLF and NUL characters before passing these options is recommended as a temporary mitigation until an official fix is released.