Vulnerability · Published Oct 26, 2026 · Assigned by EEF

CVE-2026-97200Unbounded response body buffering and decompression in hackney

High 8.2

In plain English

A high-severity resource allocation without limits in hackney from benoitc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 4.0)8.2High

Exploit odds (30 days)0.6%top 53.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds how much the connection process buffers. Any server the client requests can trigger it. hackney_conn:read_full_body/2 and the HTTP/2 and HTTP/3 accumulators append every chunk until the body ends. With {auto_decompress, true} the buffered body is then inflated in one step with zlib:gunzip/1 or zlib:inflate/2, which return the whole output at once. This issue affects hackney: from 2.0.0-beta.1 before 4.9.0.

Affected products (as reported)

Vendor	Product	Versions
benoitc	hackney	2.0.0-beta.1 – before 4.9.0
benoitc	hackney	dc41b79339ca0c41e16d3f2dd17172bc2de855d6 – before 493e8bf83a391548e5101792276ab3fc428fa76c

Weakness: CWE-409, CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

hackney 4.9.0 release notes vendor-advisory, related
EEF CNA record for CVE-2026-97200 related
OSV record EEF-CVE-2026-97200 related
Cap buffered response bodies with max_body_size and bound decompression (benoitc/hackney#980) related
Introducing commit dc41b79 in benoitc/hackney related
Fix commit 493e8bf in benoitc/hackney patch