Am I affected?
type your hackney version to check
Description
Uncontrolled Resource Consumption vulnerability in benoitc hackney allows Flooding.
The SOCKS5 transport in src/hackney_socks5.erl correctly applies the caller-supplied timeout to the SOCKS5 negotiation phase, but then upgrades the connection to TLS using the two-argument form ssl:connect/2, which defaults to an infinite timeout. The Timeout value is in scope at the call site but is not forwarded. A hostile SOCKS5 proxy that completes the SOCKS5 handshake normally and then goes silent (or sends a partial TLS ServerHello and stalls) will cause the connecting process to block indefinitely, regardless of the connect_timeout or recv_timeout options supplied by the caller.
This issue affects hackney: from 0.10.0 before 4.0.1.
Weaknesses & attack patterns
Weakness
CWE-400
·
Uncontrolled Resource Consumption
in catalog →
MITRE ↗
Attack patterns
CAPEC-130
·
Excessive Allocation
MITRE ↗
Affected — Hex / hackney Hex.pm ↗ Repository ↗
≥
0.10.0
<
4.0.1
affected
every other version:
unaffected
default status
unaffected
cpe
cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*
modules · source files · routines
modules
hackney_socks5
source files
src/hackney_socks5.erl
routines
hackney_socks5:connect/4
Affected — GitHub / benoitc/hackney Repository ↗
≥
34cdbd1
<
5ccdab7
affected
every other version:
unaffected
default status
unaffected
cpe
cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*
modules · source files · routines
modules
hackney_socks5
source files
src/hackney_socks5.erl
routines
hackney_socks5:connect/4
References
github.com/benoitc/hackney ·
GHSA-gp9c-pm5m-5cxr ↗
vendor-advisory
osv.dev ·
EEF-CVE-2026-47071 ↗
related
Credits
Peter Ullrich
Finder
Benoit Chesneau
Remediation developer
Jonatan Männchen / EEF
Analyst
CVSS breakdown
HIGH 8.2
open in calculator →
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N