Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis of the provided patch commit 8e02b99c28aea1b3fa2ddc0e66f51fe5bb0ac540 clearly indicates that the vulnerability lies within the setcookie/3 function in the src/hackney_cookie.erl file. The vulnerability description explicitly mentions CRLF injection in hackney_cookie:setcookie/3 due to unvalidated domain and path options. The patch confirms this by adding validation checks for these specific options within that exact function. Before the patch, the Domain and Path values were directly appended to the cookie string, allowing for header injection. The added code introduces binary:match to filter out malicious characters like CRLF, semicolons, and control characters, thus mitigating the vulnerability. Therefore, hackney_cookie.setcookie is the precise function that would appear in a runtime profile during the exploitation of this vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| hackney | erlang | >= 0.9.0, < 4.0.1 | 4.0.1 |
