Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-97200— Unbounded response body buffering and decompression in hackney

Quick assessment

Affected
benoitc hackney
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 benoitc 开发的 hackney 库中， 模块存在“资源分配无限制或缺乏节流”的漏洞。该漏洞允许恶意的 HTTP 服务器通过发送超大或高度压缩的响应体，耗尽客户端的内存。 和 函数会返回完整的响应体，而连接进程在缓冲数据时没有任何上限限制。客户端请求的任何服务器都可能触发此问题。 具体而言， 函数以及 HTTP/2 和 HTTP/3 的累加器（accumulator）会持续追加每个数据块，直到响应体结束。当配置为 时，缓冲的响应体会通过 或 一次性解压，这些函数会直接返回完整的解压输出，从而可能导致内存瞬

CVSS 8.2 · High EPSS 0.56% · P47

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 2

VendorProduct Version RangeStatus
benoitc hackney 2.0.0-beta.1< 4.9.0 affected
dc41b79339ca0c41e16d3f2dd17172bc2de855d6< 493e8bf83a391548e5101792276ab3fc428fa76c affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-97200

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Unbounded response body buffering and decompression in hackney
Source: CVE Program / CVE List V5
Vulnerability Description
Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds how much the connection process buffers. Any server the client requests can trigger it. hackney_conn:read_full_body/2 and the HTTP/2 and HTTP/3 accumulators append every chunk until the body ends. With {auto_decompress, true} the buffered body is then inflated in one step with zlib:gunzip/1 or zlib:inflate/2, which return the whole output at once. This issue affects hackney: from 2.0.0-beta.1 before 4.9.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对高度压缩数据的处理不恰当(数据放大攻击)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
benoitc hackney 2.0.0-beta.1 ~ 4.9.0 cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*
benoitc hackney dc41b79339ca0c41e16d3f2dd17172bc2de855d6 ~ 493e8bf83a391548e5101792276ab3fc428fa76c cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-97200

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-97200

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-97200 (2)

Vendor Advisories for CVE-2026-97200 (1)

Vendor Pages for CVE-2026-97200 (1)

Other References for CVE-2026-97200 (1)

Same Patch Batch · benoitc · 2026-10-26 · 5 CVEs total

CVE-2026-115693 9.1 CRITICAL Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney
CVE-2026-115700 6.9 MEDIUM SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hac
CVE-2026-113440 6.0 MEDIUM HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port i
CVE-2026-112880 2.1 LOW CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney

IV. Related Vulnerabilities

Same product: hackney
Same vendor: benoitc
Same weakness: CWE-409