Executive Summary

This vulnerability is an infinite loop issue in the benoitc hackney library, specifically in the Alt-Svc response header parser located in src/hackney_altsvc.erl. When the parser encounters certain unexpected characters (such as !, @, =, ;) in the Alt-Svc header, it fails to make forward progress and repeatedly processes the same data. This causes a tight infinite tail-recursive loop that pins a scheduler at 100% CPU usage, effectively hanging the calling process.

The problem arises because functions parse_token/2 and skip_comma/1 return the input unchanged when they encounter unexpected bytes, leading parse_entries/2 to recurse indefinitely with identical data. This infinite loop can be triggered by a single-byte Alt-Svc header controlled by any HTTP origin the client connects to.

This affects hackney versions from 2.0.0-beta.1 up to but not including 4.0.1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service condition by causing the affected process to hang and consume 100% CPU indefinitely. Since the infinite loop occurs in the HTTP response processing, an attacker controlling an HTTP origin can trigger this by sending a specially crafted Alt-Svc header.

The impact is that the client application using the vulnerable hackney library may become unresponsive or degraded in performance, potentially affecting availability and reliability of services relying on it.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability causes a tight infinite tail-recursive loop that pins a scheduler at 100% CPU when processing certain Alt-Svc response headers. Detection can focus on monitoring for unusually high CPU usage in processes using the hackney library versions from 2.0.0-beta.1 before 4.0.1.

Specifically, look for processes stuck at 100% CPU during HTTP response handling, especially when Alt-Svc headers contain unexpected characters like '!'.

While no specific commands are provided, general system monitoring commands such as 'top' or 'htop' on Linux can help identify processes with high CPU usage.

Additionally, network traffic inspection tools can be used to capture HTTP responses and check for Alt-Svc headers containing unusual characters that could trigger the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves updating the hackney library to version 4.0.1 or later, where this vulnerability is fixed.

Until an update can be applied, avoid connecting to HTTP origins that send suspicious Alt-Svc headers containing non-token, non-whitespace, non-comma bytes such as '!', '@', '=', or ';'.

Monitoring and limiting HTTP responses with malformed Alt-Svc headers can reduce the risk of triggering the infinite loop.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of the CVE-2026-47066 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0