The vulnerability arises from the Alt-Svc response header parser in hackney's src/hackney_altsvc.erl module, where the functions parse_token/2 and skip_comma/1 fail to properly advance when encountering unexpected characters. This causes parse_entries/2 to recurse infinitely with the same input, resulting in a tight infinite tail-recursive loop that pins a scheduler at 100% CPU usage and causes the calling process to hang. The entry point parse_and_cache/3 is synchronously called on every HTTP response, making the client susceptible to denial of service by any HTTP origin that sends a single-byte Alt-Svc header containing a non-token, non-whitespace, non-comma byte such as '!'. The issue affects hackney versions from 2.0.0-beta.1 up to but not including 4.0.1.

An attacker controlling an HTTP origin can send a crafted Alt-Svc response header that triggers an infinite loop in the hackney client, causing the client process to hang and consume 100% CPU on a scheduler thread. This results in a denial of service condition for the affected client application. There are no indications of privilege escalation or data corruption from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is documented in the provided information. Users should monitor vendor communications for updates and consider limiting exposure to untrusted HTTP origins until a fix is available.