Infinite Loop Vulnerability in Hackney HTTP Client by Benoit C.

CVE-2026-47066

What is CVE-2026-47066?

A vulnerability exists in the Hackney HTTP client that allows for an Infinite Loop scenario caused by the parser of the Alt-Svc response header. When the parser encounters an unrecognized byte, it fails to advance, leading to a tight recursive loop that consumes CPU resources indefinitely. This behavior can be initiated by a single-byte Alt-Svc response header, which can be controlled by any HTTP origin. As a result, processes can become unresponsive, severely impacting application performance and stability.

References