PT-2026-43068 · Hackney · Hackney

Benoit Chesneau + 2 · CVE-2026-47071 · Published 2026-05-25 · Updated 2026-07-24

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions hackney versions 0.10.0 through 4.0.0

Description Uncontrolled Resource Consumption in the SOCKS5 transport within src/hackney socks5.erl allows flooding. While the caller-supplied timeout is applied during the SOCKS5 negotiation phase, the connection upgrade to TLS via the ssl:connect/2 function defaults to an infinite timeout because the Timeout variable is not forwarded. Consequently, a hostile SOCKS5 proxy that completes the handshake and then stalls or sends a partial TLS ServerHello can cause the connecting process to block indefinitely, ignoring the connect timeout or recv timeout options.

Recommendations Update hackney to version 4.0.1.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-47071

GHSA-GP9C-PM5M-5CXR

Affected Products

Hackney

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47071.json · Exploit
• 🔥 https://github.com/benoitc/hackney/security/advisories/GHSA-gp9c-pm5m-5cxr · Exploit
• https://github.com/benoitc/hackney/commit/5ccdab725c561a6f03d05a51f2d0664f98236dae · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-47071 · Security Note
• https://cna.erlef.org/cves/CVE-2026-47071.html · Patch
• https://osv.dev/vulnerability/CVE-2026-47071 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gp9c-pm5m-5cxr · Vendor Advisory
• https://github.com/benoitc/hackney · Note
• https://repo.hex.pm · Note
• https://osv.dev/vulnerability/EEF-CVE-2026-47071 · Vendor Advisory, Patch
• https://t.me/cveNotify/219868 · Telegram Post
• https://github.com · Note
• https://t.me/cveNotify/164841 · Telegram Post
• https://hex.pm/packages/hackney · Note