CVE-2026-47077— Unbounded body accumulation in HTTP/3 response loop in hackney
Possible ATT&CK Techniques 1AI
T1496 · Resource HijackingGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-47077
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unbounded body accumulation in HTTP/3 response loop in hackney
Source: NVD (National Vulnerability Database)
Vulnerability Description
Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. hackney_h3:await_response_loop/6 accumulates the HTTP/3 response body in memory without any size cap. The after Timeout clause is a per-message inactivity timer that resets on every received chunk, housekeeping message, or settings frame — it is not a wall-clock deadline. A malicious HTTP/3 server that emits one small chunk every Timeout - 1 ms with Fin = false and never sends a final frame keeps the loop alive indefinitely while the accumulation buffer grows linearly without bound, eventually exhausting the BEAM process heap and causing an out-of-memory condition. This issue affects hackney: from 2.0.0 before 4.0.1.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-47077
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47077
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-47077 (1)
Vendor Advisories for CVE-2026-47077 (3)
- EEF-CVE-2026-47077 - OSVrelated
Same Patch Batch · benoitc · 2026-05-25 · 10 CVEs total
| CVE-2026-47070 | HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect ta | |
| CVE-2026-47069 | CRLF injection in cookie domain/path options in hackney | |
| CVE-2026-47076 | SSRF allowlist bypass via percent-encoded host in hackney | |
| CVE-2026-47073 | Unbounded memory consumption in WebSocket client in hackney | |
| CVE-2026-47075 | CR/LF injection in query parameter in hackney | |
| CVE-2026-47072 | CRLF injection in WebSocket upgrade request in hackney | |
| CVE-2026-47067 | Atom table exhaustion via unrecognized URL schemes in hackney | |
| CVE-2026-47071 | SOCKS5 TLS upgrade ignores caller timeout in hackney | |
| CVE-2026-47066 | Infinite loop in Alt-Svc header parser in hackney |
IV. Related Vulnerabilities
Same product: hackney
- CVE-2026-47067
Atom table exhaustion via unrecognized URL schemes in hackne - CVE-2026-47073
Unbounded memory consumption in WebSocket client in hackney - CVE-2026-47072
CRLF injection in WebSocket upgrade request in hackney - CVE-2026-47076
SSRF allowlist bypass via percent-encoded host in hackney - CVE-2026-47070
HTTP/3 redirect handler leaks Authorization and Cookie heade
Same vendor: benoitc
- CVE-2026-47067
Atom table exhaustion via unrecognized URL schemes in hackne - CVE-2026-47073
Unbounded memory consumption in WebSocket client in hackney - CVE-2026-47072
CRLF injection in WebSocket upgrade request in hackney - CVE-2026-47076
SSRF allowlist bypass via percent-encoded host in hackney - CVE-2026-47070
HTTP/3 redirect handler leaks Authorization and Cookie heade
Same weakness: CWE-400
- CVE-2026-48593
Unbounded range expansion in cron describe causes memory exh - CVE-2026-8856
IBM HTTP Server is affected by multiple vulnerabilities - CVE-2026-47073
Unbounded memory consumption in WebSocket client in hackney - CVE-2026-47071
SOCKS5 TLS upgrade ignores caller timeout in hackney - CVE-2026-5308
Missing request body size limits on Zoom plugin HTTP endpoin
V. Comments for CVE-2026-47077
No comments yet