Answer in brief
CVE-2026-112880 records a Low severity (CVSS 2.1) vulnerability in CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney. The current sources do not mark it as known exploited. The current feed maps benoitc/benoitc/hackney (generic), benoitc/hackney (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 2.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps benoitc/benoitc/hackney (generic), benoitc/hackney (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| benoitc/benoitc/hackneygeneric | >=5df5a74a2817d5b12880d217db33253ff1fae1b5 <5ee7d7d19eba27e774667d472feb1e93a08af7f9 | 5ee7d7d19eba27e774667d472feb1e93a08af7f9 |
| benoitc/hackneygeneric | >=2.0.0 <4.9.0 | 4.9.0 |
Published upstream
Oct 26, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 26, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 26, 2026
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback returns. After a 407 response from an HTTP CONNECT proxy, hackney_http_connect:handle_proxy_auth/11 calls the caller's proxy_auth_fun with the status code and the response headers and writes the returned binary into the Proxy-Authorization line of the CONNECT retry without checking it. A CR, LF or NUL byte in that value adds header lines to the request sent to the proxy. The value is attacker-influenced when the callback derives it from untrusted data, for example from the proxy's challenge headers. Other caller-supplied values on the CONNECT path, such as the target host and the request headers, were already checked for control bytes. This issue affects hackney: from 2.0.0 before 4.9.0.
Quoted source text, attributed separately from HOL analysis.