Quick answers
- Is CVE-2026-47077 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-47077 being exploited in the wild.
- How severe is CVE-2026-47077?
- High severity, with a CVSS score of 7.5, published 25 May 2026.
- Which products and versions are affected?
- Benoit Chesneau Hackney >= 2.0.0, < 4.0.1.
- Is there a fix for CVE-2026-47077?
- A patch was published on 2026-05-25: Fix committed in version 4.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-47077 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-47077?
- Check whether you run Benoit Chesneau Hackney at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An allocation of resources without limits or throttling vulnerability exists in hackney_h3:await_response_loop/6. The component accumulates HTTP/3 response bodies in memory without a size cap, and its inactivity timer resets on every received chunk rather than enforcing a global wall-clock deadline. A malicious HTTP/3 server can exploit this by emitting small data chunks just before the timeout expires, keeping the connection alive indefinitely. This causes the accumulation buffer to grow linearly until the BEAM process heap is exhausted, leading to an out-of-memory (OOM) crash. This vulnerability specifically affects the HTTP/3 transport; the default TCP/TLS transports are not impacted.
Affected products
- benoitc hackney >= 2.0.0, < 4.0.1
Identifiers
- CVE-2026-47077
- GHSA-76v6-f83q-pxvh
Timeline
- 2026-05-25: disclosed: Initial disclosure by maintainer
- 2026-05-25: patched: Fix committed in version 4.0.1
- 2026-05-26: advisory: GitHub Advisory published