Resource Exhaustion Vulnerability in Hackney by BenoitC

CVE-2026-47073

What is CVE-2026-47073?

A resource exhaustion vulnerability exists in the Hackney HTTP client library, allowing attackers to exploit the WebSocket client. This flaw stems from the absence of limits on memory allocation across multiple code paths. Specifically, the read_handshake_response/3 function grows a buffer indefinitely when receiving streamed bytes, while certain functions neglect to validate payload lengths in adherence to documented standards. Furthermore, the frag_buffer in #ws_data{} can accumulate fragmented frames without a definitive endpoint, leading to excessive memory usage. This vulnerability requires the attacker to control the WebSocket server connected by the Hackney client, without necessitating any authentication or specific client configurations.

References