CVE-2026-47074: ex-aws ex_aws_sns signature bypass in verify_message/1

Executive brief

Hackney, a popular HTTP client library for Erlang, contains a vulnerability when using the HTTP/3 transport protocol. A malicious server can send data very slowly in a way that prevents the client's timeout from ever triggering, while simultaneously forcing the client to store an unlimited amount of data in memory. This can lead to a denial-of-service condition where the application crashes or the entire system runs out of memory.

Technical details

The vulnerability exists in `hackney_h3:await_response_loop/6` within `src/hackney_h3.erl`. The loop accumulates HTTP/3 response body chunks in memory without a size limit (`max_body` check). Furthermore, the `after Timeout` clause acts as a per-message inactivity timer rather than a monotonic wall-clock deadline; receiving any `stream_data` chunk or housekeeping message resets the timer. An attacker-controlled HTTP/3 server can drip small chunks just before the timeout expires, causing linear memory growth until the BEAM process heap is exhausted (OOM). This only affects the HTTP/3 transport; the default TCP/TLS transports are not impacted. The issue is fixed in version 4.0.1.

Affected products

• benoitc hackney >= 4.0.0, < 4.0.1

Timeline

• 2026-05-25: disclosed
• 2026-05-28: advisory: NVD publication date
• 2026-06-26: patched: GitHub Advisory reviewed/updated date

References

• https://api.github.com/users/PJUllrich
• https://github.com/PJUllrich
• https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D
• https://api.github.com/users/PJUllrich/repos
• https://avatars.githubusercontent.com/u/10426523?v=4
• https://api.github.com/users/PJUllrich/events%7B/privacy%7D