PT-2026-43070 · Benoitc · Hackney

Benoit Chesneau + 2 · Published 2026-05-25 · Updated 2026-05-25 · CVE-2026-47073

Mitre

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The WebSocket client in src/hackney ws.erl imposes no upper bound on memory consumption in three code paths. First, read handshake response/3 accumulates received bytes into a growing buffer with no size cap; the per-receive timeout resets on every chunk, so a server that streams bytes without ever sending r r causes the buffer to grow until memory is exhausted. Second, parse payload/9 and parse active payload/8 do not validate the declared frame payload length against any limit; because RFC 6455 allows payload lengths up to 2^63-1 bytes, a server that announces a very large frame and dribbles bytes causes the accumulation buffer to grow until OOM. Third, the frag buffer field in #ws data{} accumulates continuation frames indefinitely; a server that sends an endless stream of non-final (nofin) fragmented frames without ever sending a final (fin) frame grows frag buffer without bound.

In all three cases the attacker only needs to control the WebSocket server the hackney client connects to, with no authentication or special client configuration required.

This issue affects hackney: from 2.0.0 before 4.0.1.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-47073

Affected Products

Hackney

References · 4

• https://github.com/benoitc/hackney/security/advisories/GHSA-q8jg-fgj4-fphf · Vendor Advisory
• https://github.com/benoitc/hackney/commit/ce0109e2970ace6e20ff29bae9d05c3ac22ec6dc · Patch
• https://cna.erlef.org/cves/CVE-2026-47073.html · Note
• https://osv.dev/vulnerability/EEF-CVE-2026-47073 · Note