Executive brief
Hackney, a popular HTTP client library for the Erlang ecosystem, contains a flaw in how it handles HTTP/3 connections. A malicious web server can send data very slowly to a client using this library, causing the client to consume an unlimited amount of memory. This can lead to a complete crash of the application or the server it is running on, resulting in a denial of service.
Technical details
An allocation of resources without limits or throttling vulnerability exists in hackney_h3:await_response_loop/6. The component accumulates HTTP/3 response bodies in memory without a size cap, and its inactivity timer resets on every received chunk rather than enforcing a global wall-clock deadline. A malicious HTTP/3 server can exploit this by emitting small data chunks just before the timeout expires, keeping the connection alive indefinitely. This causes the accumulation buffer to grow linearly until the BEAM process heap is exhausted, leading to an out-of-memory (OOM) crash. This vulnerability specifically affects the HTTP/3 transport; the default TCP/TLS transports are not impacted.
Affected products
- benoitc hackney >= 2.0.0, < 4.0.1
Timeline
- 2026-05-25: disclosed: Initial disclosure by maintainer
- 2026-05-25: patched: Fix committed in version 4.0.1
- 2026-05-26: advisory: GitHub Advisory published