Resource Exhaustion Vulnerability in Hackney HTTP Client by BenoitC

CVE-2026-47077

What is CVE-2026-47077?

A resource exhaustion vulnerability exists in the Hackney HTTP client, where the accumulation of HTTP/3 response bodies in memory is unbounded. Specifically, the function hackney_h3:await_response_loop/6 lacks a size limit on the accumulated response body, making it susceptible to flooding attacks. An attacker could exploit this by sending small chunks of data with an inactive final frame, which keeps the accumulation buffer growing indefinitely. As a result, this can lead to an out-of-memory condition in the BEAM process, severely impacting the performance and stability of applications using Hackney.

References