The vulnerability CVE-2026-47075 in benoitc hackney (versions before 4.0.1) is due to improper neutralization of CRLF sequences (CWE-93). Specifically, hackney_url:make_url/3 passes the query binary directly without validating or escaping carriage return (\r) and line feed (\n) characters, which must be percent-encoded according to RFC 3986 Section 3.4. This flaw allows an attacker who can control the URL to inject raw CRLF sequences into the HTTP request target, enabling HTTP request splitting and arbitrary HTTP header injection.

Successful exploitation can allow an attacker to manipulate HTTP requests by injecting arbitrary headers or splitting the request, potentially leading to security issues such as cache poisoning, cross-site scripting, or other HTTP-based attacks. The CVSS 4.0 score is 6.8 (medium severity), reflecting the local attack vector, low attack complexity, partial user interaction, and high impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is indicated, users should monitor the vendor's communications for updates. Until a fix is available, avoid passing untrusted input directly into the URL query component or implement input validation and percent-encoding of CRLF characters before passing URLs to hackney.