CVE-2026-97200
Unbounded response body buffering and decompression in hackney
- State
- Published
- Severity
- 8.2 High
- Published
- Oct 26, 2026
- Updated
- Oct 26, 2026
- Reserved
- Oct 26, 2026
Description
Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds how much the connection process buffers. Any server the client requests can trigger it.
hackney_conn:read_full_body/2 and the HTTP/2 and HTTP/3 accumulators append every chunk until the body ends. With {auto_decompress, true} the buffered body is then inflated in one step with zlib:gunzip/1 or zlib:inflate/2, which return the whole output at once.
This issue affects hackney: from 2.0.0-beta.1 before 4.9.0.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.2 High | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | EEF |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
hackneybenoitc |
|
hackneybenoitc |
|
References
- hackney 4.9.0 release notesvendor-advisoryrelated
- EEF CNA record for CVE-2026-97200related
- OSV record EEF-CVE-2026-97200related
- Cap buffered response bodies with max_body_size and bound decompression (benoitc/hackney#980)related
- Introducing commit dc41b79 in benoitc/hackneyrelated
- Fix commit 493e8bf in benoitc/hackneypatch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.