CVE-2026-47073: Benoitc Hackney denial of service (CVSS 7.5)

Description

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The WebSocket client in src/hackney_ws.erl imposes no upper bound on memory consumption in three code paths. First, read_handshake_response/3 accumulates received bytes into a growing buffer with no size cap; the per-receive timeout resets on every chunk, so a server that streams bytes without ever sending \r\n\r\n causes the buffer to grow until memory is exhausted. Second, parse_payload/9 and parse_active_payload/8 do not validate the declared frame payload length against any limit; because RFC 6455 allows payload lengths up to 2^63-1 bytes, a server that announces a very large frame and dribbles bytes causes the accumulation buffer to grow until OOM. Third, the frag_buffer field in #ws_data{} accumulates continuation frames indefinitely; a server that sends an endless stream of non-final (nofin) fragmented frames without ever sending a final (fin) frame grows frag_buffer without bound. In all three cases the attacker only needs to control the WebSocket server the hackney client connects to, with no authentication or special client configuration required. This issue affects hackney: from 2.0.0 before 4.0.1.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityNone

IntegrityNone

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Benoitc Hackney≥ 2.0.0 < 4.0.1

Remediation

Fixed in

Benoitc Hackney≥ 4.0.1

Patch & vendor advisories

References

https://cna.erlef.org/cves/CVE-2026-47073.htmlPatchThird Party Advisory
https://github.com/benoitc/hackney/commit/ce0109e2970ace6e20ff29bae9d05c3ac22ec6dcPatch
https://github.com/benoitc/hackney/security/advisories/GHSA-q8jg-fgj4-fphfExploitPatchVendor Advisory
https://osv.dev/vulnerability/EEF-CVE-2026-47073PatchThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-47073 being actively exploited?

CVE-2026-47073 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.82%.

How severe is CVE-2026-47073?

CVE-2026-47073 has a CVSS 3.1 base score of 7.5, rated high. EPSS estimates a 0.82% probability of exploitation.

Which products are affected by CVE-2026-47073?

Affected products include Benoitc Hackney.

How do I fix CVE-2026-47073?

Upgrade affected software to a fixed version, for example Benoitc Hackney 4.0.1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-47073 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo