Resource Exhaustion Vulnerability in Hackney HTTP Client by Benoitc

CVE-2026-97200

What is CVE-2026-97200?

The Hackney HTTP client by Benoitc faces a resource exhaustion vulnerability due to the mishandling of overly large or highly compressed response bodies from HTTP servers. An attacker could exploit this flaw to exhaust client memory, as there are no limits on how much data can be buffered during the response processing. The vulnerable functions, hackney:request/5 and hackney:body/1, do not impose restrictions on the connection process's memory usage. Consequently, any server that the client interacts with risks triggering this vulnerability, especially when using the auto-decompression features with zlib. Users are advised to upgrade to version 4.9.0 or later to mitigate this security risk.

References