Weakness Type (CWE)

CWE-400 — CWE-400 Uncontrolled Resource Consumption

CAPEC

CVSS 4.0 Score

8.2

HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability description

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding.

hackney_h3:await_response_loop/6 accumulates the HTTP/3 response body in memory without any size cap. The after Timeout clause is a per-message inactivity timer that resets on every received chunk, housekeeping message, or settings frame — it is not a wall-clock deadline. A malicious HTTP/3 server that emits one small chunk every Timeout - 1 ms with Fin = false and never sends a final frame keeps the loop alive indefinitely while the accumulation buffer grows linearly without bound, eventually exhausting the BEAM process heap and causing an out-of-memory condition.

This issue affects hackney: from 2.0.0 before 4.0.1.

Affected

pkg:hex/hackney

Module Source File Routine
hackney_h3 src/hackney_h3.erl hackney_h3:await_response_loop/6
Status Type Version Changes / Fixed in
affected semver ⓘ 2.0.0 < 4.0.1

pkg:github/benoitc/hackney

Module Source File Routine
hackney_h3 src/hackney_h3.erl hackney_h3:await_response_loop/6
Status Type Version Changes / Fixed in
affected git ⓘ 0334af206d < 3d25f9fea2

Configurations

The application must use the HTTP/3 transport by calling hackney_h3 directly or by passing {transport, h3} to hackney:request/5. The default hackney transport (TCP/TLS) is not affected.

References

Credits

  • Finder: Peter Ullrich
  • Remediation developer: Benoit Chesneau
  • Analyst: Jonatan Männchen

CVE record as JSON:  GET /cves/CVE-2026-47077.json
OSV record as JSON:  GET /osv/EEF-CVE-2026-47077.json