---
id: CVE-2026-97200
title: Unbounded response body buffering and decompression in hackney
summary: >-
  Allocation of Resources Without Limits or Throttling vulnerability in
  hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust
  client memory via an oversized or highly compressed response body.
  hackney:request/5 and hack…
severity: high
cvss: 8.2
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-409
  - CWE-770
vendor: benoitc
product: hackney
affected:
  - hackney >= 2.0.0-beta.1 < 4.9.0
  - >-
    benoitc/hackney >= dc41b79339ca0c41e16d3f2dd17172bc2de855d6 <
    493e8bf83a391548e5101792276ab3fc428fa76c
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-26T14:54:57.385457Z'
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T15:35:50.487Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-97200'
references:
  - url: 'https://github.com/benoitc/hackney/releases/tag/4.9.0'
    label: hackney 4.9.0 release notes
  - url: 'https://cna.erlef.org/cves/CVE-2026-97200.html'
    label: EEF CNA record for CVE-2026-97200
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-97200'
    label: OSV record EEF-CVE-2026-97200
  - url: 'https://github.com/benoitc/hackney/pull/980'
    label: >-
      Cap buffered response bodies with max_body_size and bound decompression
      (benoitc/hackney#980)
  - url: >-
      https://github.com/benoitc/hackney/commit/dc41b79339ca0c41e16d3f2dd17172bc2de855d6
    label: Introducing commit dc41b79 in benoitc/hackney
  - url: >-
      https://github.com/benoitc/hackney/commit/493e8bf83a391548e5101792276ab3fc428fa76c
    label: Fix commit 493e8bf in benoitc/hackney
tags:
  - cve.org
ingestedAt: '2026-10-26T14:27:31.813Z'
---

## Overview

Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds how much the connection process buffers. Any server the client requests can trigger it.

hackney_conn:read_full_body/2 and the HTTP/2 and HTTP/3 accumulators append every chunk until the body ends. With {auto_decompress, true} the buffered body is then inflated in one step with zlib:gunzip/1 or zlib:inflate/2, which return the whole output at once.

This issue affects hackney: from 2.0.0-beta.1 before 4.9.0.

## Affected

- `hackney >= 2.0.0-beta.1 < 4.9.0`
- `benoitc/hackney >= dc41b79339ca0c41e16d3f2dd17172bc2de855d6 < 493e8bf83a391548e5101792276ab3fc428fa76c`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Leave auto_decompress disabled (the default). Without it hackney_conn:maybe_decompress_body/2 never inflates the body, which closes the amplification half. The uncapped raw body read has no workaround.