High 8.2Published Oct 26, 2026

CVE-2026-97200Unbounded response body buffering and decompression in hackney

Updated under an hour ago (Oct 28, 2026, 12:50 PM ET)

Does this affect you?

It affects benoitc hackney. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for benoitc hackney

Exploited in the last 30 days

Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds how much the connection process buffers. Any server the client requests can trigger it. hackney_conn:read_full_body/2 and the HTTP/2 and HTTP/3 accumulators append every chunk until the body ends. With {auto_decompress, true} the buffered body is then inflated in one step with zlib:gunzip/1 or zlib:inflate/2, which return the whole output at once. This issue affects hackney: from 2.0.0-beta.1 before 4.9.0.

CVSS: 8.2 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-409, CWE-770
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: EEF
NVD analysis: Awaiting Analysis
Record last updated: Oct 26, 2026
First seen by InfoSec Signals: Oct 26, 2026

Affected products

Affected products

benoitc hackney benoitc:hackney	from 2.0.0-beta.1 before 4.9.0	CNA record

References

References

https://github.com/benoitc/hackney/releases/tag/4.9.0	vendor-advisory, related
https://cna.erlef.org/cves/CVE-2026-97200.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-97200	related
https://github.com/benoitc/hackney/pull/980	related
https://github.com/benoitc/hackney/commit/dc41b79339ca0c41e16d3f2dd17172bc2de855d6	related
https://github.com/benoitc/hackney/commit/493e8bf83a391548e5101792276ab3fc428fa76c	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.