CVE-2026-47077: Benoitc Hackney denial of service (CVSS 7.5)

Description

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. hackney_h3:await_response_loop/6 accumulates the HTTP/3 response body in memory without any size cap. The after Timeout clause is a per-message inactivity timer that resets on every received chunk, housekeeping message, or settings frame — it is not a wall-clock deadline. A malicious HTTP/3 server that emits one small chunk every Timeout - 1 ms with Fin = false and never sends a final frame keeps the loop alive indefinitely while the accumulation buffer grows linearly without bound, eventually exhausting the BEAM process heap and causing an out-of-memory condition. This issue affects hackney: from 2.0.0 before 4.0.1.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityNone

IntegrityNone

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Benoitc Hackney≥ 2.0.0 < 4.0.1

Remediation

Fixed in

Benoitc Hackney≥ 4.0.1

Patch & vendor advisories

References

https://cna.erlef.org/cves/CVE-2026-47077.htmlPatchThird Party Advisory
https://github.com/benoitc/hackney/commit/3d25f9fea26c90609de9d64366fedfe5065413bcPatch
https://github.com/benoitc/hackney/security/advisories/GHSA-jq4m-q6p2-8gwcExploitPatchVendor Advisory
https://osv.dev/vulnerability/EEF-CVE-2026-47077PatchThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-47077 being actively exploited?

CVE-2026-47077 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.70%.

How severe is CVE-2026-47077?

CVE-2026-47077 has a CVSS 3.1 base score of 7.5, rated high. EPSS estimates a 0.70% probability of exploitation.

Which products are affected by CVE-2026-47077?

Affected products include Benoitc Hackney.

How do I fix CVE-2026-47077?

Upgrade affected software to a fixed version, for example Benoitc Hackney 4.0.1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-47077 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo