CVE-2026-97200: Unbounded response body buffering and decompression in hackney

Q: Which applications are exposed to this issue?

Applications using affected hackney versions are exposed when they request an HTTP resource from a malicious or untrusted server. Any server the client requests can supply the oversized or highly compressed response that triggers memory exhaustion.

Q: What does an attacker need to exploit it?

The attacker needs to control, compromise, or otherwise serve the HTTP endpoint that the application requests. No additional condition is stated beyond causing the client to process an oversized response body or, when automatic decompression is enabled, a highly compressed response.

Q: Is automatic decompression required for exploitation?

No. Unbounded buffering occurs while hackney accumulates response chunks until the body ends. Enabling {auto_decompress, true} adds a decompression-based memory-exhaustion path because the full compressed output is inflated at once.

Q: How can I determine whether my application is affected?

Check whether it uses hackney versions from 2.0.0-beta.1 before 4.9.0 and calls hackney:request/5 or hackney:body/1, or uses code paths that invoke hackney_conn:read_full_body/2 or HTTP/2 or HTTP/3 response accumulation. Review whether those requests can reach untrusted or attacker-controlled servers and whether {auto_decompress, true} is enabled.

Q: What remediation is identified?

Upgrade hackney to version 4.9.0 or later. The provided data does not identify a workaround for systems that cannot immediately upgrade.

Published Oct 26, 2026

Updated

Allocation of Resources Without Limits or Throttling vulnerability in hackneyconn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds how much the connection process buffers. Any server the client requests can trigger it.

hackneyconn:readfullbody/2 and the HTTP/2 and HTTP/3 accumulators append every chunk until the body ends. With {autodecompress, true} the buffered body is then inflated in one step with zlib:gunzip/1 or zlib:inflate/2, which return the whole output at once.

This issue affects hackney: from 2.0.0-beta.1 before 4.9.0.

Affected Software

1 affected component

hex/hackney>=2.0.0-beta.1<4.9.0

Event History

Oct 26, 2026

CVE Published

via MITRE·01:49 PM

Data Sourced

via MITRE·01:49 PM

DescriptionWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using affected hackney versions are exposed when they request an HTTP resource from a malicious or untrusted server. Any server the client requests can supply the oversized or highly compressed response that triggers memory exhaustion.

What does an attacker need to exploit it?

The attacker needs to control, compromise, or otherwise serve the HTTP endpoint that the application requests. No additional condition is stated beyond causing the client to process an oversized response body or, when automatic decompression is enabled, a highly compressed response.

Is automatic decompression required for exploitation?

No. Unbounded buffering occurs while hackney accumulates response chunks until the body ends. Enabling {auto_decompress, true} adds a decompression-based memory-exhaustion path because the full compressed output is inflated at once.

How can I determine whether my application is affected?

Check whether it uses hackney versions from 2.0.0-beta.1 before 4.9.0 and calls hackney:request/5 or hackney:body/1, or uses code paths that invoke hackney_conn:read_full_body/2 or HTTP/2 or HTTP/3 response accumulation. Review whether those requests can reach untrusted or attacker-controlled servers and whether {auto_decompress, true} is enabled.

What remediation is identified?

Upgrade hackney to version 4.9.0 or later. The provided data does not identify a workaround for systems that cannot immediately upgrade.

CVE-2026-97200: Unbounded response body buffering and decompression in hackney

Affected Software

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

Is automatic decompression required for exploitation?

How can I determine whether my application is affected?

What remediation is identified?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

Is automatic decompression required for exploitation?

How can I determine whether my application is affected?

What remediation is identified?