CVE-2026-47071 Details
Description
Uncontrolled Resource Consumption vulnerability in benoitc hackney allows Flooding. The SOCKS5 transport in src/hackney_socks5.erl correctly applies the caller-supplied timeout to the SOCKS5 negotiation phase, but then upgrades the connection to TLS using the two-argument form ssl:connect/2, which defaults to an infinite timeout. The Timeout value is in scope at the call site but is not forwarded. A hostile SOCKS5 proxy that completes the SOCKS5 handshake normally and then goes silent (or sends a partial TLS ServerHello and stalls) will cause the connecting process to block indefinitely, regardless of the connect_timeout or recv_timeout options supplied by the caller. This issue affects hackney: from 0.10.0 before 4.0.1.
A denial-of-service vulnerability has been identified in the benoitc hackney library, specifically in versions 0.10.0 prior to 4.0.1. The issue arises in the SOCKS5 transport module, where the library correctly applies user-defined timeouts during the SOCKS5 negotiation phase. However, once the connection is upgraded to TLS using the two-argument form of ssl:connect/2, which defaults to an infinite timeout, the original timeout is not forwarded. This oversight allows a malicious SOCKS5 proxy to complete the handshake and then stall the TLS exchange, causing the connecting process to block indefinitely. This behavior ignores any connect_timeout or recv_timeout options specified by the user, leading to unbounded resource consumption.
Users can upgrade to hackney version 4.0.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/benoitc/hackney/security/advisories/GHSA-gp9c-pm5m-5cxr | CISA-ADP | ExploitPatchVendor Advisory |
| https://cna.erlef.org/cves/CVE-2026-47071.html | EEF | PatchThird Party Advisory |
| https://github.com/benoitc/hackney/commit/5ccdab725c561a6f03d05a51f2d0664f98236dae | EEF | Patch |
| https://github.com/benoitc/hackney/security/advisories/GHSA-gp9c-pm5m-5cxr | EEF | ExploitPatchVendor Advisory |
| https://osv.dev/vulnerability/EEF-CVE-2026-47071 | EEF | PatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | EEF |
Affected Products
| Product | Versions |
|---|---|
| benoitc hackney | >= 0.10.0, < 4.0.1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | Initial Analysis | [email protected] |
| May 26, 2026 | CVE Modified | CISA-ADP |
| May 25, 2026 | New CVE Received | EEF |