CVE-2026-47066 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-47066HIGH

benoitc hackney — Infinite loop in Alt-Svc header parser in hackney

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7   .0075   52.2     —

AFFECTED
  Product  Versions                                    Fixed
  hackney  2.0.0-beta.1 –                              —
  hackney  408e5fe20302226ea8c74dde2bcbd452d712b5b2 –  —

TIMELINE
  May 18  Reserved by EEF
  May 25  EXPLOIT PUBLISHED — CVE-2026-47066 (benoitc hackney). Public exploit reference added.
  May 25  Published (CNA: EEF)

CWE-835 · CNA: EEF · CVSS v4.0 · 4 references · NVD status: Analyzed

Description

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in benoitc hackney allows Excessive Allocation. The Alt-Svc response header parser in src/hackney_altsvc.erl does not guarantee forward progress. When parse_token/2 receives a non-token, non-whitespace, non-comma byte (e.g. !, @, =, ;), it returns the input unchanged. skip_comma/1 also returns the buffer unchanged when the first byte is not a comma. parse_entries/2 then recurses with identical data, creating a tight infinite tail-recursive loop that pins a scheduler at 100% CPU. The calling process never returns. The entry point parse_and_cache/3 is called synchronously in the connection process on every HTTP response. A single-byte Alt-Svc: ! response header is sufficient to trigger the hang; the header is fully controlled by any HTTP origin the client connects to. This issue affects hackney: from 2.0.0-beta.1 before 4.0.1.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
May 18, 2026	Reserved	Reserved by EEF
May 25, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-47066 (benoitc hackney). Public exploit reference added.
May 25, 2026	Published	Published (CNA: EEF)

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
benoitc	hackney	—	2.0.0-beta.1	—
benoitc	hackney	—	408e5fe20302226ea8c74dde2bcbd452d712b5b2	—

Weaknesses

CWE-835

References (4)

https://cna.erlef.org/cves/CVE-2026-47066.html [Patch, Third Party Advisory]
https://github.com/benoitc/hackney/commit/e548aba1f97ffa3f4750da7b772998fb78c01894 [Patch]
https://github.com/benoitc/hackney/security/advisories/GHSA-6cp8-v795-jr2j [Exploit, Patch, Vendor Advisory]
https://osv.dev/vulnerability/EEF-CVE-2026-47066 [Patch, Third Party Advisory]

Authoritative record: CVE-2026-47066 at cve.org

Vendors: benoitc

Weaknesses: CWE-835

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-47066 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.