CVE-2026-47071
Received Received - Intake
Uncontrolled Resource Consumption in hackney

Publication date: 2026-05-25

Last updated on: 2026-05-25

Assigner: EEF

Description
Uncontrolled Resource Consumption vulnerability in benoitc hackney allows Flooding. The SOCKS5 transport in src/hackney_socks5.erl correctly applies the caller-supplied timeout to the SOCKS5 negotiation phase, but then upgrades the connection to TLS using the two-argument form ssl:connect/2, which defaults to an infinite timeout. The Timeout value is in scope at the call site but is not forwarded. A hostile SOCKS5 proxy that completes the SOCKS5 handshake normally and then goes silent (or sends a partial TLS ServerHello and stalls) will cause the connecting process to block indefinitely, regardless of the connect_timeout or recv_timeout options supplied by the caller. This issue affects hackney: from 0.10.0 before 4.0.1.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-25
Last Modified
2026-05-25
Generated
2026-05-26
AI Q&A
2026-05-26
EPSS Evaluated
N/A
NVD
CVE-2026-47071
EUVD
EUVD-2026-31685
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
benoitc hackney From 0.10.0 (inc) to 4.0.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is an Uncontrolled Resource Consumption issue in the benoitc hackney library related to its SOCKS5 transport implementation. Specifically, during the SOCKS5 negotiation phase, a caller-supplied timeout is correctly applied. However, when the connection is upgraded to TLS using ssl:connect/2, the timeout is not forwarded and defaults to infinite. As a result, a hostile SOCKS5 proxy that completes the handshake but then becomes silent or stalls during the TLS handshake can cause the connecting process to block indefinitely.


How can this vulnerability impact me? :

The impact of this vulnerability is that a malicious SOCKS5 proxy can cause a denial of service by making the connecting process block indefinitely. This uncontrolled resource consumption can lead to system resource exhaustion, potentially degrading service availability or causing application crashes.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart