# CVE-2026-47074: ex-aws ex_aws_sns signature bypass in verify_message/1

Source: https://junglewise.ai/threats/cve-2026-47074-ex-aws-ex-aws-sns-signature-bypass-in-verify-message-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-47074 · Severity: high · CVSS 8.7 · Published 2026-05-28

Hackney, a popular HTTP client library for Erlang, contains a vulnerability when using the HTTP/3 transport protocol. A malicious server can send data very slowly in a way that prevents the client's timeout from ever triggering, while simultaneously forcing the client to store an unlimited amount of data in memory. This can lead to a denial-of-service condition where the application crashes or the entire system runs out of memory.

Technologies: [Benoit Chesneau Hackney](https://junglewise.ai/threats/technologies/hackney). Vendors: [Benoit Chesneau](https://junglewise.ai/threats/vendors/benoit-chesneau).

## Quick answers

**Is CVE-2026-47074 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47074 being exploited in the wild.

**How severe is CVE-2026-47074?** High severity, with a CVSS score of 8.7, published 28 May 2026.

**Which products and versions are affected?** Benoit Chesneau Hackney >= 4.0.0, < 4.0.1; ExAws.SNS >= 2.0.1, < 2.3.5.

**Is there a fix for CVE-2026-47074?** A patch was published on 2026-06-26: GitHub Advisory reviewed/updated date Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47074 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-47074?** Check whether you run Benoit Chesneau Hackney or ExAws.SNS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in `hackney_h3:await_response_loop/6` within `src/hackney_h3.erl`. The loop accumulates HTTP/3 response body chunks in memory without a size limit (`max_body` check). Furthermore, the `after Timeout` clause acts as a per-message inactivity timer rather than a monotonic wall-clock deadline; receiving any `stream_data` chunk or housekeeping message resets the timer. An attacker-controlled HTTP/3 server can drip small chunks just before the timeout expires, causing linear memory growth until the BEAM process heap is exhausted (OOM). This only affects the HTTP/3 transport; the default TCP/TLS transports are not impacted. The issue is fixed in version 4.0.1.

## Affected products

- benoitc hackney >= 4.0.0, < 4.0.1

## Identifiers

- CVE-2026-47074
- GHSA-jq4m-q6p2-8gwc

## Timeline

- 2026-05-25: disclosed
- 2026-05-28: advisory: NVD publication date
- 2026-06-26: patched: GitHub Advisory reviewed/updated date

## References

- [https://api.github.com/users/PJUllrich](https://api.github.com/users/PJUllrich)
- [https://github.com/PJUllrich](https://github.com/PJUllrich)
- [https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D](https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D)
- [https://api.github.com/users/PJUllrich/repos](https://api.github.com/users/PJUllrich/repos)
- [https://avatars.githubusercontent.com/u/10426523?v=4](https://avatars.githubusercontent.com/u/10426523?v=4)
- [https://api.github.com/users/PJUllrich/events%7B/privacy%7D](https://api.github.com/users/PJUllrich/events%7B/privacy%7D)

## Related threats

- [ex-aws ex_aws_sns signature bypass via untrusted SigningCertURL](https://junglewise.ai/threats/ex-aws-ex-aws-sns-signature-bypass-via-untrusted-signingcerturl-0591112d)
- [benoitc hackney resource exhaustion in HTTP/3 response loop](https://junglewise.ai/threats/cve-2026-47077-benoitc-hackney-resource-exhaustion-in-http-3-response-loop)
- [benoitc hackney SSRF via percent-encoded host in normalize/2](https://junglewise.ai/threats/cve-2026-47076-benoitc-hackney-ssrf-via-percent-encoded-host-in-normalize-2)
- [benoitc hackney unbounded memory consumption in WebSocket client](https://junglewise.ai/threats/cve-2026-47073-benoitc-hackney-unbounded-memory-consumption-in-websocket-client)
- [Benoitc hackney CRLF injection in WebSocket upgrade request](https://junglewise.ai/threats/cve-2026-47072-benoitc-hackney-crlf-injection-in-websocket-upgrade-request)