Uncontrolled Resource Consumption in Benoitc Hackney's SOCKS5 Transport

CVE-2026-47071

What is CVE-2026-47071?

The Hackney library for Erlang allows an uncontrolled resource consumption attack due to a flaw in the SOCKS5 transport implementation. While the timeout set by the caller applies during the SOCKS5 negotiation, it fails to be propagated when the connection is upgraded to TLS, resulting in an infinite timeout by default. This vulnerability can be exploited by a malicious SOCKS5 proxy, which can complete the SOCKS5 handshake and then remain silent or provide an incomplete TLS ServerHello, thus causing the connecting process to hang indefinitely. Users of Hackney versions from 0.10.0 to 4.0.0 should take immediate measures to secure their applications against this vulnerability.

References