Threats tagged 'ghsa-5qp8-qrjx-2669'

CVE-2026-112880 is a vulnerability in the hackney_http_connect module of the benoitc hackney HTTP client library. It allows HTTP Request/Response Splitting due to improper neutralization of CRLF sequences in HTTP headers. Specifically, the proxy_auth_fun callback's return value is inserted into the Proxy-Authorization header without validation, enabling injection of additional header lines if it contains CR, LF, or NUL bytes. This affects hackney versions from 2.0.0 up to but not including 4.9.0.