CVE-2026-47066 Details
Description
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in benoitc hackney allows Excessive Allocation. The Alt-Svc response header parser in src/hackney_altsvc.erl does not guarantee forward progress. When parse_token/2 receives a non-token, non-whitespace, non-comma byte (e.g. !, @, =, ;), it returns the input unchanged. skip_comma/1 also returns the buffer unchanged when the first byte is not a comma. parse_entries/2 then recurses with identical data, creating a tight infinite tail-recursive loop that pins a scheduler at 100% CPU. The calling process never returns. The entry point parse_and_cache/3 is called synchronously in the connection process on every HTTP response. A single-byte Alt-Svc: ! response header is sufficient to trigger the hang; the header is fully controlled by any HTTP origin the client connects to. This issue affects hackney: from 2.0.0-beta.1 before 4.0.1.
A denial-of-service vulnerability has been identified in the Benoitc Hackney HTTP client library, specifically in versions 2.0.0-beta.1 prior to 4.0.1. The issue arises in the Alt-Svc response header parser, where the handling of non-token bytes creates an infinite loop. When the parser encounters a non-token byte (such as '!', '@', '=', ';', or '.'), it fails to consume the byte and instead returns it unchanged. This behavior, combined with the parser's lack of progress control, leads to a tail-recursive loop that consumes CPU resources, effectively hanging the connection process. The vulnerability can be triggered by a single-byte Alt-Svc header from an attacker-controlled HTTP origin, causing the affected process to remain unresponsive and pinned at 100% CPU usage.
Users can upgrade to Hackney version 4.0.1, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/benoitc/hackney/security/advisories/GHSA-6cp8-v795-jr2j | CISA-ADP | ExploitPatchVendor Advisory |
| https://cna.erlef.org/cves/CVE-2026-47066.html | EEF | PatchThird Party Advisory |
| https://github.com/benoitc/hackney/commit/e548aba1f97ffa3f4750da7b772998fb78c01894 | EEF | Patch |
| https://github.com/benoitc/hackney/security/advisories/GHSA-6cp8-v795-jr2j | EEF | ExploitPatchVendor Advisory |
| https://osv.dev/vulnerability/EEF-CVE-2026-47066 | EEF | PatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | EEF |
Affected Products
| Product | Versions |
|---|---|
| benoitc hackney | >= 2.0.0, < 4.0.1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | Initial Analysis | [email protected] |
| May 26, 2026 | CVE Modified | CISA-ADP |
| May 25, 2026 | New CVE Received | EEF |