# CVE-2026-47073: benoitc hackney unbounded memory consumption in WebSocket client

Source: https://junglewise.ai/threats/cve-2026-47073-benoitc-hackney-unbounded-memory-consumption-in-websocket-client  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-25. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-47073 · Severity: high · CVSS 8.7 · Published 2026-05-25

Hackney, a popular HTTP and WebSocket client for Erlang, contains a vulnerability that allows a malicious server to crash the application using it. By sending an endless stream of data or incomplete messages, a server can force the Hackney client to consume all available system memory. This results in a denial-of-service (DoS) condition, potentially taking down the entire service or server node.

Technologies: [Benoit Chesneau Hackney](https://junglewise.ai/threats/technologies/hackney). Vendors: [Benoit Chesneau](https://junglewise.ai/threats/vendors/benoit-chesneau).

## Quick answers

**Is CVE-2026-47073 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47073 being exploited in the wild.

**How severe is CVE-2026-47073?** High severity, with a CVSS score of 8.7, published 25 May 2026.

**Which products and versions are affected?** Benoit Chesneau Hackney >= 2.0.0, < 4.0.1.

**Is there a fix for CVE-2026-47073?** A patch was published on 2026-06-26. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47073 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-47073?** Check whether you run Benoit Chesneau Hackney at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The WebSocket client in `src/hackney_ws.erl` fails to impose upper bounds on memory consumption across three code paths: handshake response buffering, frame payload accumulation, and fragmentation buffering. In the handshake phase, `read_handshake_response/3` accumulates bytes indefinitely if the `\r\n\r\n` terminator is never sent. During frame parsing, `parse_payload/9` and `parse_active_payload/8` append incoming chunks to a buffer without validating the declared length against system limits. Finally, the `frag_buffer` can grow without bound if a server sends an endless stream of continuation frames without a final frame. An attacker-controlled WebSocket server can exploit these behaviors to cause an Out-Of-Memory (OOM) crash of the BEAM virtual machine. The vulnerability is patched in version 4.0.1.

## Affected products

- benoitc hackney >= 2.0.0, < 4.0.1

## Identifiers

- CVE-2026-47073
- GHSA-q8jg-fgj4-fphf

## Timeline

- 2026-05-25: disclosed
- 2026-06-26: advisory: GitHub Advisory published
- 2026-06-26: patched

## References

- [https://api.github.com/users/PJUllrich](https://api.github.com/users/PJUllrich)
- [https://github.com/PJUllrich](https://github.com/PJUllrich)
- [https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D](https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D)
- [https://api.github.com/users/PJUllrich/repos](https://api.github.com/users/PJUllrich/repos)
- [https://avatars.githubusercontent.com/u/10426523?v=4](https://avatars.githubusercontent.com/u/10426523?v=4)
- [https://api.github.com/users/PJUllrich/events%7B/privacy%7D](https://api.github.com/users/PJUllrich/events%7B/privacy%7D)

## Related threats

- [ex-aws ex_aws_sns signature bypass in verify_message/1](https://junglewise.ai/threats/cve-2026-47074-ex-aws-ex-aws-sns-signature-bypass-in-verify-message-1)
- [benoitc hackney resource exhaustion in HTTP/3 response loop](https://junglewise.ai/threats/cve-2026-47077-benoitc-hackney-resource-exhaustion-in-http-3-response-loop)
- [benoitc hackney SSRF via percent-encoded host in normalize/2](https://junglewise.ai/threats/cve-2026-47076-benoitc-hackney-ssrf-via-percent-encoded-host-in-normalize-2)
- [Benoitc hackney CRLF injection in WebSocket upgrade request](https://junglewise.ai/threats/cve-2026-47072-benoitc-hackney-crlf-injection-in-websocket-upgrade-request)
- [benoitc hackney sensitive data exposure in HTTP/3 redirect handler](https://junglewise.ai/threats/cve-2026-47070-benoitc-hackney-sensitive-data-exposure-in-http-3-redirect)