CVE-2026-47073 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-47073HIGH

benoitc hackney — Unbounded memory consumption in WebSocket client in hackney

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7   .0085   55.4     —

AFFECTED
  Product  Versions                                    Fixed
  hackney  2.0.0 –                                     —
  hackney  690cecaf236fba49526da404a5bc889a24367a3e –  —

TIMELINE
  May 18  Reserved by EEF
  May 25  EXPLOIT PUBLISHED — CVE-2026-47073 (benoitc hackney). Public exploit reference added.
  May 25  Published (CNA: EEF)

CWE-400 · CNA: EEF · CVSS v4.0 · 4 references · NVD status: Analyzed

Description

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The WebSocket client in src/hackney_ws.erl imposes no upper bound on memory consumption in three code paths. First, read_handshake_response/3 accumulates received bytes into a growing buffer with no size cap; the per-receive timeout resets on every chunk, so a server that streams bytes without ever sending \r\n\r\n causes the buffer to grow until memory is exhausted. Second, parse_payload/9 and parse_active_payload/8 do not validate the declared frame payload length against any limit; because RFC 6455 allows payload lengths up to 2^63-1 bytes, a server that announces a very large frame and dribbles bytes causes the accumulation buffer to grow until OOM. Third, the frag_buffer field in #ws_data{} accumulates continuation frames indefinitely; a server that sends an endless stream of non-final (nofin) fragmented frames without ever sending a final (fin) frame grows frag_buffer without bound. In all three cases the attacker only needs to control the WebSocket server the hackney client connects to, with no authentication or special client configuration required. This issue affects hackney: from 2.0.0 before 4.0.1.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
May 18, 2026	Reserved	Reserved by EEF
May 25, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-47073 (benoitc hackney). Public exploit reference added.
May 25, 2026	Published	Published (CNA: EEF)

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
benoitc	hackney	—	2.0.0	—
benoitc	hackney	—	690cecaf236fba49526da404a5bc889a24367a3e	—

Weaknesses

CWE-400

References (4)

https://cna.erlef.org/cves/CVE-2026-47073.html [Patch, Third Party Advisory]
https://github.com/benoitc/hackney/commit/ce0109e2970ace6e20ff29bae9d05c3ac22ec6dc [Patch]
https://github.com/benoitc/hackney/security/advisories/GHSA-q8jg-fgj4-fphf [Exploit, Patch, Vendor Advisory]
https://osv.dev/vulnerability/EEF-CVE-2026-47073 [Patch, Third Party Advisory]

Authoritative record: CVE-2026-47073 at cve.org

Vendors: benoitc

Weaknesses: CWE-400

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-47073 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.