PT-2026-43073 · Hackney · Hackney
Benoit Chesneau
+2
·
Published
2026-05-25
·
Updated
2026-06-26
·
CVE-2026-47077
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
hackney versions 2.0.0 through 4.0.0
Description
An allocation of resources without limits or throttling allows flooding. The function
await response loop/6 in hackney h3 accumulates the HTTP/3 response body in memory without a size cap. Because the timeout clause acts as a per-message inactivity timer that resets upon receiving chunks, housekeeping messages, or settings frames rather than a fixed deadline, a malicious HTTP/3 server can keep the loop active indefinitely. By emitting small chunks just before the timeout expires with Fin set to false and omitting a final frame, the server causes the accumulation buffer to grow linearly, exhausting the BEAM process heap and leading to an out-of-memory condition. This issue occurs when the application uses the HTTP/3 transport via hackney h3 or by passing {transport, h3} to hackney:request/5.Recommendations
Update to version 4.0.1.
As a temporary mitigation, avoid using the HTTP/3 transport by not calling
hackney h3 directly and avoiding the {transport, h3} option in hackney:request/5.Exploit
Fix
Resource Exhaustion
Improper Certificate Validation
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Hackney