Vulnerability in hackney (CVE-2026-47073)
Summary
Vulnerability in hackney (CVE-2026-47073). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 4.0.1 or later.
Original description
The description as published by the source.
Summary
Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The WebSocket client in src/hackney_ws.erl imposes no upper bound on memory consumption in three code paths. First, read_handshake_response/3 accumulates received bytes into a growing buffer with no size cap; the per-receive timeout resets on every chunk, so a server that streams bytes without ever sending \r\n\r\n causes the buffer to grow until memory is exhausted. Second, parse_payload/9 and parse_active_payload/8 do not validate the declared frame payload length against any limit; because RFC 6455 allows payload lengths up to 2^63-1 bytes, a server that announces a very large frame and dribbles bytes causes the accumulation buffer to grow until OOM. Third, the frag_buffer field in #ws_data{} accumulates continuation frames indefinitely; a server that sends an endless stream of non-final (nofin) fragmented frames without ever sending a final (fin) frame grows frag_buffer without bound.
In all three cases the attacker only needs to control the WebSocket server the hackney client connects to, with no authentication or special client configuration required.
This issue affects hackney: from 2.0.0 before 4.0.1.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-47073 has been found in hackney.
Risk of unauthorized operations or information disclosure. CVSS score: 7.5/10.
What to do: upgrade hackney to 4.0.1 or later.
If unsure, ask your IT team or search "hackney CVE-2026-47073" on the vendor's site.
CVE-2026-47073 (hackney) — CWE-400 / CVSS v3 7.5
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Patched: 4.0.1 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-400) exists in hackney.
Check the vendor advisory for the affected versions of hackney.
Severity: High (CVSS 7.5/10). Risk of unauthorized operations or information disclosure.
Update to 4.0.1.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'hackney' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'hackney' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
hackneyを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade hackney to 4.0.1ステージング環境で 4.0.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory github.com
- advisory nvd.nist.gov
- package hex.pm
- package github.com
- patch github.com
- web cna.erlef.org
- web osv.dev
- web github.com