benoitc hackney up to 4.0.0 Alt-Svc Response Header Parser src/hackney_altsvc.erl infinite loop

Summaryinfo

A vulnerability was found in benoitc hackney up to 4.0.0. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the file src/hackney_altsvc.erl of the component Alt-Svc Response Header Parser. The manipulation leads to infinite loop. This vulnerability is traded as CVE-2026-47066. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in benoitc hackney up to 4.0.0. This issue affects an unknown function of the file src/hackney_altsvc.erl of the component Alt-Svc Response Header Parser. The manipulation with an unknown input leads to a infinite loop vulnerability. Using CWE to declare the problem leads to CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. Impacted is availability. The summary by CVE is:

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in benoitc hackney allows Excessive Allocation. The Alt-Svc response header parser in src/hackney_altsvc.erl does not guarantee forward progress. When parse_token/2 receives a non-token, non-whitespace, non-comma byte (e.g. !, @, =, ;), it returns the input unchanged. skip_comma/1 also returns the buffer unchanged when the first byte is not a comma. parse_entries/2 then recurses with identical data, creating a tight infinite tail-recursive loop that pins a scheduler at 100% CPU. The calling process never returns. The entry point parse_and_cache/3 is called synchronously in the connection process on every HTTP response. A single-byte Alt-Svc: ! response header is sufficient to trigger the hang; the header is fully controlled by any HTTP origin the client connects to. This issue affects hackney: from 2.0.0-beta.1 before 4.0.1.

The weakness was shared by Peter Ullrich and Jonatan Männchen. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-47066 since 05/18/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 4.0.1 eliminates this vulnerability. Applying the patch e548aba1f97ffa3f4750da7b772998fb78c01894 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-31686). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• benoitc

Name

• hackney

Version

• 4.0

Website

• Product: https://github.com/benoitc/hackney/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion