CVE-2026-97200

Name of the Vulnerable Software and Affected Versions hackney versions 2.0.0-beta.1 through 4.8.9

Description A resource allocation issue in hackney conn allows a malicious HTTP server to exhaust client memory by sending an oversized or highly compressed response body. The functions hackney:request/5 and hackney:body/1 return the entire response body without limits on how much the connection process buffers. Specifically, hackney conn:read full body/2 and the HTTP/2 and HTTP/3 accumulators append every chunk until the body ends.

When the {auto decompress, true} option is used, the buffered body is inflated in a single step using zlib:gunzip/1 or zlib:inflate/2, which return the entire output at once. This can lead to significant memory amplification; for example, a 1 MB gzip body can inflate to 1 GB.

Recommendations Update to version 4.9.0 or later. As a temporary mitigation, keep auto decompress disabled to prevent memory amplification during decompression.