CVE-2026-97200High· 8.2▾ TwilightAllocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hack…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds how much the connection process buffers. Any server the client requests can trigger it.
hackney_conn:read_full_body/2 and the HTTP/2 and HTTP/3 accumulators append every chunk until the body ends. With {auto_decompress, true} the buffered body is then inflated in one step with zlib:gunzip/1 or zlib:inflate/2, which return the whole output at once.
This issue affects hackney: from 2.0.0-beta.1 before 4.9.0.
hackney >= 2.0.0-beta.1 < 4.9.0benoitc/hackney >= dc41b79339ca0c41e16d3f2dd17172bc2de855d6 < 493e8bf83a391548e5101792276ab3fc428fa76cRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Leave auto_decompress disabled (the default). Without it hackney_conn:maybe_decompress_body/2 never inflates the body, which closes the amplification half. The uncapped raw body read has no workaround.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113440Medium· 6.0HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney
CVE-2026-112880Low· 2.1CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney
CVE-2026-115693Critical· 9.1Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney
CVE-2026-115700Medium· 6.9SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney
CVE-2026-47067HighHackney vulnerable to atom-table exhaustion via unrecognized URL schemes
CVE-2026-114136High· 7.5djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser (CVE-2026-114136)