CVE-2026-97200: Unbounded response body buffering and decompression in hackney

Vulnerability summary

CVE-2026-97200 is a high (CVSS 8.2) vulnerability in benoitc hackney. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 46.9% of scored vulnerabilities.

Timeline

1. 26-10-2026
   PublishedVulnerability first disclosed.
2. 26-10-2026
   Last modifiedVulnerability information updated.

Description

Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds how much the connection process buffers. Any server the client requests can trigger it. hackney_conn:read_full_body/2 and the HTTP/2 and HTTP/3 accumulators append every chunk until the body ends. With {auto_decompress, true} the buffered body is then inflated in one step with zlib:gunzip/1 or zlib:inflate/2, which return the whole output at once. This issue affects hackney: from 2.0.0-beta.1 before 4.9.0.

• CWE-409Improper Handling of Highly Compressed Data (Data Amplification)The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.