CVE-2026-47066: benoitc hackney infinite loop in Alt-Svc header parser

Executive brief

Hackney, a popular HTTP client library for Erlang, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted response header that causes the library to enter an infinite loop, consuming 100% of the server's CPU and causing the application to hang. This can lead to a complete service outage for any application that connects to a malicious or compromised web server.

Technical details

The vulnerability is an infinite loop (CWE-835) located in `src/hackney_altsvc.erl`. When the `Alt-Svc` header parser encounters a non-token byte (such as `!`, `@`, or `=`) at the start of an entry, the `parse_token/2` function fails to consume any input and returns the original buffer. Because `parse_entries/2` does not detect this lack of progress, it recursively calls itself with the identical buffer, resulting in a tight tail-recursive loop. This pins an Erlang scheduler at 100% CPU and prevents the process from yielding. The issue is reachable via any synchronous HTTP response containing the malicious header and is fixed in version 4.0.1.

Affected products

• benoitc hackney >= 2.0.0, < 4.0.1

Timeline

• 2026-05-25: disclosed: NVD publication date
• 2026-06-26: advisory: GitHub Advisory published
• 2026-06-26: patched: Fixed in version 4.0.1

References

• https://api.github.com/users/PJUllrich
• https://github.com/PJUllrich
• https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D
• https://api.github.com/users/PJUllrich/repos
• https://avatars.githubusercontent.com/u/10426523?v=4
• https://api.github.com/users/PJUllrich/events%7B/privacy%7D