The vulnerability arises because hackney does not properly percent-encode CR (\r) and LF (\n) characters in the URL query component before constructing the HTTP/1.1 request target. According to RFC 3986 Section 3.4, characters outside the defined grammar must be percent-encoded, but hackney_url:make_url/3 passes the query binary directly without validation or escaping. This allows an attacker who can control the URL to inject raw CRLF sequences, enabling HTTP request splitting and arbitrary HTTP header injection. The affected versions are from 0.13.1 up to but not including 4.0.1.

An attacker able to control the URL query component can inject CRLF sequences into HTTP requests, potentially allowing HTTP request splitting attacks. This can lead to injection of arbitrary HTTP headers or manipulation of the HTTP request structure. The CVSS 4.0 score is 6.8 (medium severity), indicating a significant but not critical impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a fix is available, avoid passing untrusted input directly into the URL query component in hackney. Implement input validation or percent-encoding of CR and LF characters before passing URLs to hackney to mitigate injection risks.