CVE-2026-97200
Awaiting Analysis Awaiting Analysis - Queue

Allocation of Resources Without Limits or Throttling in hackney

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: EEF

Description
Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds how much the connection process buffers. Any server the client requests can trigger it. hackney_conn:read_full_body/2 and the HTTP/2 and HTTP/3 accumulators append every chunk until the body ends. With {auto_decompress, true} the buffered body is then inflated in one step with zlib:gunzip/1 or zlib:inflate/2, which return the whole output at once. This issue affects hackney: from 2.0.0-beta.1 before 4.9.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-97200
EUVD
EUVD-2026-109837

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
benoitc hackney 2.0.0-beta.1
benoitc hackney dc41b79339ca0c41e16d3f2dd17172bc2de855d6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an allocation of resources without limits or throttling issue in the hackney library. A malicious HTTP server can exhaust client memory by sending an oversized or highly compressed response body. The client processes (hackney:request/5 and hackney:body/1) return the entire response body without bounding the buffer size, allowing any server to trigger excessive memory usage.

Detection Guidance

This vulnerability is specific to applications using the hackney library versions 2.0.0-beta.1 to 4.9.0. To detect it, check if your application depends on hackney and verify the version. Look for unusually high memory usage in the client process during HTTP requests, especially when receiving large or compressed responses.

Impact Analysis

This vulnerability can cause denial of service by consuming all available memory on the client system. Any HTTP server the client connects to could exploit this to crash the application or system by sending a large or compressed response.

Mitigation Strategies

Upgrade hackney to version 4.9.0 or later to address the issue. If upgrading is not immediately possible, consider disabling automatic decompression by setting {auto_decompress, false} in HTTP client configurations. Monitor memory usage during HTTP requests to detect abnormal behavior.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97200. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart