CVE-2026-97200: hackney: Unbounded response body buffering and decompression in Erlang HTTP client

Summary

The hackney Erlang/Elixir HTTP client buffers complete HTTP response bodies in memory without any size limit. With auto_decompress enabled, compressed bodies are also inflated in one step, so a small compressed response can expand to a very large size. A malicious HTTP server that the client connects to can exhaust the memory of the client process or node, causing denial of service; no authentication is needed.

Affected

hackney from 2.0.0-beta.1 before 4.9.0
Git range dc41b79339ca0c41e16d3f2dd17172bc2de855d6 to before 493e8bf83a391548e5101792276ab3fc428fa76c

Fixed in

Fixed in hackney 4.9.0 (fix commit 493e8bf83a391548e5101792276ab3fc428fa76c, related PR #980)
A newer 4.9.x release may exist; verify on the release page before pinning

Workaround

Keep auto_decompress disabled (the default); this closes the decompression amplification part
The unbounded raw body read has no workaround
Restrict which URLs the application fetches, especially user-supplied ones

Exploitation

No evidence of exploitation in the wild; not listed in CISA KEV
CISA SSVC: exploitation none, automatable yes, technical impact partial
The CNA record describes a reproduction method; EPSS 0.00564

Our recommendation

Inventory Erlang/Elixir applications and lockfiles (rebar.lock, mix.lock) for hackney versions below 4.9.0, including transitive dependencies such as HTTPoison
Upgrade to hackney 4.9.0 or the latest 4.9.x and test the new 512 MiB limit for buffered bodies (max_body_size)
If an upgrade is delayed, disable auto_decompress where it is not needed and restrict outbound requests to trusted URLs
Monitor application memory usage for unexpected growth

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

CNA record CVE-2026-97200 (EEF) cna.erlef.org
OSV record EEF-CVE-2026-97200 osv.dev
hackney 4.9.0 release github.com
Fix commit 493e8bf github.com
Introducing commit dc41b79 github.com
Pull request #980 github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:57.

Original description (NVD)

Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds how much the connection process buffers. Any server the client requests can trigger it. hackney_conn:read_full_body/2 and the HTTP/2 and HTTP/3 accumulators append every chunk until the body ends. With {auto_decompress, true} the buffered body is then inflated in one step with zlib:gunzip/1 or zlib:inflate/2, which return the whole output at once. This issue affects hackney: from 2.0.0-beta.1 before 4.9.0.

NVD references (6)

Sources

The tracker combines official, freely usable data sources – updated continuously:

NVD (NIST) – CVEs, rating (CVSS), affected products
CISA KEV – vulnerabilities confirmed by CISA as actively exploited
CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
FIRST EPSS – probability of exploitation
Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
PoC-in-GitHub – public proof-of-concept repositories
Metasploit (Rapid7) – modules of the Metasploit Framework
Exploit-DB (OffSec) – archive of public exploits (links only)
Patch days: official vendor pages (linked per vendor) (Vendor patch days)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed