Detection Guidance

This vulnerability involves unbounded accumulation of HTTP/3 response body data in memory when using the hackney HTTP client library with HTTP/3 transport. Detection involves monitoring for abnormal memory usage patterns in processes running hackney versions from 2.0.0 before 4.0.1, especially those using HTTP/3.

Since the issue is specific to HTTP/3 transport and involves the function hackney_h3:await_response_loop/6 accumulating data without limits, you can detect it by observing unusually high memory consumption or out-of-memory conditions in BEAM processes handling HTTP/3 responses.

There are no explicit commands provided in the resources, but general approaches include:

• Monitor BEAM process memory usage with Erlang tools such as observer or recon.
• Use system monitoring tools (e.g., top, htop) to detect processes with growing memory consumption.
• Capture and analyze HTTP/3 traffic to identify servers sending small chunks repeatedly just before the inactivity timeout.
• Check hackney version in use to confirm if it is vulnerable (versions from 2.0.0 before 4.0.1).

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade hackney to version 4.0.1 or later, where the vulnerability has been patched.

The patch introduces an absolute wall-clock deadline for the entire HTTP/3 response and caps the buffered response body size to a configurable maximum (default 512 MiB). If the body exceeds this limit, the connection aborts with an error, preventing unbounded memory growth.

If upgrading immediately is not possible, consider avoiding the use of HTTP/3 transport in hackney or explicitly configure hackney to not use HTTP/3 by not setting `{transport, h3}` in `hackney:request/5`.

Additionally, monitor memory usage of BEAM processes to detect potential exploitation attempts and restart affected processes if necessary.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is an Allocation of Resources Without Limits or Throttling issue in the benoitc hackney library, specifically in the hackney_h3:await_response_loop/6 function. The function accumulates the HTTP/3 response body in memory without any size limit. A malicious HTTP/3 server can exploit this by sending small chunks of data just before the timeout expires, keeping the loop alive indefinitely without sending a final frame. This causes the accumulation buffer to grow continuously, eventually exhausting the memory of the BEAM process and causing an out-of-memory condition.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that a malicious HTTP/3 server can cause a denial of service by exhausting the memory of the affected process. This happens because the vulnerable function accumulates response data without limits, leading to an out-of-memory condition that can crash or severely degrade the performance of applications using the affected hackney versions.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of the CVE-2026-47077 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0