CVE-2026-47077 Details
Description
Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. hackney_h3:await_response_loop/6 accumulates the HTTP/3 response body in memory without any size cap. The after Timeout clause is a per-message inactivity timer that resets on every received chunk, housekeeping message, or settings frame — it is not a wall-clock deadline. A malicious HTTP/3 server that emits one small chunk every Timeout - 1 ms with Fin = false and never sends a final frame keeps the loop alive indefinitely while the accumulation buffer grows linearly without bound, eventually exhausting the BEAM process heap and causing an out-of-memory condition. This issue affects hackney: from 2.0.0 before 4.0.1.
A vulnerability in the Benoitc Hackney HTTP client library, specifically in versions 2.0.0 prior to 4.0.1, allows for unbounded accumulation of HTTP/3 response data in memory. This flaw arises in the 'hackney_h3:await_response_loop/6' function, where the response body is collected without any size limit. The issue can be exploited by a malicious HTTP/3 server that sends small data chunks at intervals just before the timeout expires, effectively keeping the connection alive indefinitely. As a result, the memory buffer grows uncontrollably, leading to exhaustion of the BEAM process heap and causing an out-of-memory error.
Users can upgrade to Hackney version 4.0.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/benoitc/hackney/security/advisories/GHSA-jq4m-q6p2-8gwc | CISA-ADP | ExploitPatchVendor Advisory |
| https://cna.erlef.org/cves/CVE-2026-47077.html | EEF | PatchThird Party Advisory |
| https://github.com/benoitc/hackney/commit/3d25f9fea26c90609de9d64366fedfe5065413bc | EEF | Patch |
| https://github.com/benoitc/hackney/security/advisories/GHSA-jq4m-q6p2-8gwc | EEF | ExploitPatchVendor Advisory |
| https://osv.dev/vulnerability/EEF-CVE-2026-47077 | EEF | PatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | EEF |
Affected Products
| Product | Versions |
|---|---|
| benoitc hackney | >= 2.0.0, < 4.0.1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | Initial Analysis | [email protected] |
| May 26, 2026 | CVE Modified | CISA-ADP |
| May 25, 2026 | New CVE Received | EEF |