benoitc hackney up to 4.0.0 Housekeeping Message resource consumption

Summaryinfo

A vulnerability marked as problematic has been reported in benoitc hackney up to 4.0.0. Affected by this issue is some unknown functionality of the component Housekeeping Message Handler. This manipulation causes resource consumption. The identification of this vulnerability is CVE-2026-47077. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in benoitc hackney up to 4.0.0. Affected by this vulnerability is an unknown code of the component Housekeeping Message Handler. The manipulation with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. The summary by CVE is:

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. hackney_h3:await_response_loop/6 accumulates the HTTP/3 response body in memory without any size cap. The after Timeout clause is a per-message inactivity timer that resets on every received chunk, housekeeping message, or settings frame — it is not a wall-clock deadline. A malicious HTTP/3 server that emits one small chunk every Timeout - 1 ms with Fin = false and never sends a final frame keeps the loop alive indefinitely while the accumulation buffer grows linearly without bound, eventually exhausting the BEAM process heap and causing an out-of-memory condition. This issue affects hackney: from 2.0.0 before 4.0.1.

The weakness was shared by Peter Ullrich and Jonatan Männchen. The advisory is shared at github.com. This vulnerability is known as CVE-2026-47077 since 05/18/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 4.0.1 eliminates this vulnerability. Applying the patch 3d25f9fea26c90609de9d64366fedfe5065413bc is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-31688). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• benoitc

Name

• hackney

Version

• 4.0

Website

• Product: https://github.com/benoitc/hackney/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion