# CVE-2026-47077: benoitc hackney resource exhaustion in HTTP/3 response loop

Source: https://junglewise.ai/threats/cve-2026-47077-benoitc-hackney-resource-exhaustion-in-http-3-response-loop  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-25. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-47077 · Severity: high · CVSS 7.5 · Published 2026-05-25

Hackney, a popular HTTP client library for the Erlang ecosystem, contains a flaw in how it handles HTTP/3 connections. A malicious web server can send data very slowly to a client using this library, causing the client to consume an unlimited amount of memory. This can lead to a complete crash of the application or the server it is running on, resulting in a denial of service.

Technologies: [Benoit Chesneau Hackney](https://junglewise.ai/threats/technologies/hackney). Vendors: [Benoit Chesneau](https://junglewise.ai/threats/vendors/benoit-chesneau).

## Quick answers

**Is CVE-2026-47077 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47077 being exploited in the wild.

**How severe is CVE-2026-47077?** High severity, with a CVSS score of 7.5, published 25 May 2026.

**Which products and versions are affected?** Benoit Chesneau Hackney >= 2.0.0, < 4.0.1.

**Is there a fix for CVE-2026-47077?** A patch was published on 2026-05-25: Fix committed in version 4.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47077 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-47077?** Check whether you run Benoit Chesneau Hackney at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An allocation of resources without limits or throttling vulnerability exists in hackney_h3:await_response_loop/6. The component accumulates HTTP/3 response bodies in memory without a size cap, and its inactivity timer resets on every received chunk rather than enforcing a global wall-clock deadline. A malicious HTTP/3 server can exploit this by emitting small data chunks just before the timeout expires, keeping the connection alive indefinitely. This causes the accumulation buffer to grow linearly until the BEAM process heap is exhausted, leading to an out-of-memory (OOM) crash. This vulnerability specifically affects the HTTP/3 transport; the default TCP/TLS transports are not impacted.

## Affected products

- benoitc hackney >= 2.0.0, < 4.0.1

## Identifiers

- CVE-2026-47077
- GHSA-76v6-f83q-pxvh

## Timeline

- 2026-05-25: disclosed: Initial disclosure by maintainer
- 2026-05-25: patched: Fix committed in version 4.0.1
- 2026-05-26: advisory: GitHub Advisory published

## References

- [https://github.com/benoitc/hackney/security/advisories/GHSA-jq4m-q6p2-8gwc](https://github.com/benoitc/hackney/security/advisories/GHSA-jq4m-q6p2-8gwc)
- [https://github.com/benoitc/hackney/commit/3d25f9fea26c90609de9d64366fedfe5065413bc](https://github.com/benoitc/hackney/commit/3d25f9fea26c90609de9d64366fedfe5065413bc)
- [https://cna.erlef.org/cves/CVE-2026-47077.html](https://cna.erlef.org/cves/CVE-2026-47077.html)

## Related threats

- [ex-aws ex_aws_sns signature bypass in verify_message/1](https://junglewise.ai/threats/cve-2026-47074-ex-aws-ex-aws-sns-signature-bypass-in-verify-message-1)
- [benoitc hackney SSRF via percent-encoded host in normalize/2](https://junglewise.ai/threats/cve-2026-47076-benoitc-hackney-ssrf-via-percent-encoded-host-in-normalize-2)
- [benoitc hackney unbounded memory consumption in WebSocket client](https://junglewise.ai/threats/cve-2026-47073-benoitc-hackney-unbounded-memory-consumption-in-websocket-client)
- [Benoitc hackney CRLF injection in WebSocket upgrade request](https://junglewise.ai/threats/cve-2026-47072-benoitc-hackney-crlf-injection-in-websocket-upgrade-request)
- [benoitc hackney sensitive data exposure in HTTP/3 redirect handler](https://junglewise.ai/threats/cve-2026-47070-benoitc-hackney-sensitive-data-exposure-in-http-3-redirect)